Tracing Anonymity with Coalgebras
Ichiro Hasuo

c 2008 Ichiro Hasuo
Copyright 
ISBN: 978-90-9022827-3
IPA Dissertation Series 2008-09

Typeset with LATEX 2εCover design by Kumiko Arai
Printed by PrintPartners Ipskamp B.V.

The work in this thesis has been carried out under the auspices of the research school
IPA (Institute for Programming research and Algorithmics). The author was employed at Radboud University Nijmegen and funded by the NWO Pionier project for
security and correctness of computer programs in April 2004–April 2007. Since May
2007 he has been employed at Kyoto University, Japan.

Tracing Anonymity with Coalgebras

een wetenschappelijke proeve op het gebied
van de Natuurwetenschappen, Wiskunde en Informatica

Proefschrift

ter verkrijging van de graad van doctor
aan de Radboud Universiteit Nijmegenop gezag van de rector magniﬁcus prof. mr. S.C.J.J. Kortmann,
volgens besluit van het College van Decanen
in het openbaar te verdedigen op maandag 10 maart 2008
om 13.30 uur precies

door

Ichiro Hasuo

geboren op 27 september 1978
te Omuta, Japan

Promotor:
prof. dr. B.P.F. Jacobs

Manuscriptcommissie:
prof. dr. J. Adámek
prof. dr. J.H. Geuvers
prof. dr. M. Hasegawa
dr. D. Pavlović
prof. dr. J.J.M.M. Rutten

Technical University of Braunschweig, Germany
Kyoto University, Japan
Univ. of Oxford, UK and Kestrel Institute, US
CWI and Free University Amsterdam

Preface

This thesis could have never been ﬁnished without the teaching, support, encouragement, advice, criticism and help of many. It is a hopeless endeavor to list them all.
The ﬁrst to name is of course my PhD supervisor Bart Jacobs who not only went
beyond perfection in his supervision but also supported me as my best friend. The
starting sentences of this preface (which I found hard to come up with) are shamelessly
stolen from his book [61].
I have had great support from my friends in academia. Thanks to Jiřı́ Adámek,
Herman Geuvers, Masahito Hasegawa, Duško Pavlović and Jan Rutten for examining this thesis as the reading committee members. I beneﬁted from their criticism
and encouragement. It was a lot of pleasure to work with the following coauthors:
David Galindo, Flavio Garcia, Chris Heunen, Bart Jacobs, Yoshinobu Kawabe, Wolter
Pieters, Peter van Rossum, Ana Sokolova and Tarmo Uustalu. During my PhD study
I have made several visits and I thank the hosts for their hospitality, comments andteaching: Yoshinobu Kawabe, Joseph Kiniry, Bartek Klin, Naoki Kobayashi, Alexander Kurz, Catuscia Palamidessi, John Power, Ana Sokolova, Yde Venema and Hiroshi
Watanabe. Special thanks to Dirk Pattinson who led me to the theory of coalgebras through his lectures at NASSLLI’03. In my MSc study I learned a lot fromRyo Kashima, Izumi Takeuti and Hiroshi Watanabe. Without their encouragement,
I would never have come to the Netherlands for my PhD study. Besides, I owe muchto comments from and discussion with: Kazuyuki Asada, David Costa, Stefan Milius,
Milad Niqui, Koki Nishizawa, Shinya Katsumata, Clemens Kupke, Christian Kissig,
Erik Poll, Bas Spitters, and Frits Vaandrager.
I had great support also from outside academia. Thanks to Désirée Hermans,
Maria van Kuppeveld, Mirèse Willems from Radboud University Nijmegen and Keiko
Nishimori from Kyoto University for their administrative support. Coming to theNetherlands was my ﬁrst time living abroad. It is probably not the easiest thing butv

I enjoyed it a lot. Special thanks to all the friends and colleagues here in Nijmegen,especially to Jisk Attema, Igor Di Marco, Ab Polman and Ellie Polman who sharedhouses with me.
Finally, some words go to my family. Thanks to Kumiko Arai for the cover designand everything. Thanks to Yoshio Egashira, Hiromi Hasuo and Takeshi Hasuo, forjust everything.

Ichiro Hasuo
Nijmegen, January 2008

Contents

Prefacev

1 Introduction
1.1 Computer systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.2 Coalgebras as systems . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3 Theory of coalgebras . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.4 Thesis outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
1.5 Information for reading . . . . . . . . . . . . . . . . . . . . . . . . . .

1
1
1
4
12
19

2 Trace semantics via coinduction
2.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2 Coalgebras in a Kleisli category . . . . . . . . . . . . . . . . . . . . . .
2.3 Final coalgebra in a Kleisli category . . . . . . . . . . . . . . . . . . .
2.4 Finite trace semantics via coinduction . . . . . . . . . . . . . . . . . .
2.5 Trace semantics as testing equivalence . . . . . . . . . . . . . . . . . .
2.6 Summary and future work . . . . . . . . . . . . . . . . . . . . . . . . .

21
21
27
37
45
50
58

3 Generic forward and backward simulations
3.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2 Coalgebraic forward and backward simulations . . . . . . . . . . . . .
3.3 Soundness and completeness theorems . . . . . . . . . . . . . . . . . .
3.4 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3.5 Summary and future work . . . . . . . . . . . . . . . . . . . . . . . . .

61
61
63
76
81
86

vii

4 Case study: probabilistic anonymity
4.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2 Motivating examples . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.3 Formalizing notions for probabilistic anonymity . . . . . . . . . . . . .
4.4 Verifying strong anonymity with probabilistic simulations . . . . . . .
4.5 Verifying probable innocence with probabilistic simulations . . . . . .
4.6 Related work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
4.7 Summary and future work . . . . . . . . . . . . . . . . . . . . . . . . .

87
87
90
95
101
106
110
112

5 Foundational study: concurrency and the microcosm principle
115
5.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115
5.2 Parallel composition of coalgebras . . . . . . . . . . . . . . . . . . . . 119
5.3 Formalizing the microcosm principle . . . . . . . . . . . . . . . . . . . 124
5.4 Microcosm structures in coalgebras . . . . . . . . . . . . . . . . . . . . 136
5.5 Parallel composition of coalgebras in K(T ) . . . . . . . . . . . . . . . 138
5.6 Summary and future work . . . . . . . . . . . . . . . . . . . . . . . . . 145
Appendix A Preliminaries
147
A.1 Initial/ﬁnal sequences . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
A.2 Limit-colimit coincidence . . . . . . . . . . . . . . . . . . . . . . . . . 148
Bibliography

153

Index

164

Summary

167

Samenvatting (Dutch summary)

169

Curriculum vitae

171

Chapter 1
Introduction

The aim of this thesis is to obtain better understanding of the nature of computer
systems; in other words, to develop a mathematical theory of computer systems. Coalgebras are employed in our expedition as mathematical presentations of computer
systems.

1.1

Computer systems

Computer systems—information-processing systems consisting of (possibly multiple)
computers—are pervasive in the modern world, playing crucial roles in every aspect ofhuman activities. However, computer systems are also known to be extremely errorprone: newspapers are full of incidents caused by failure of computer systems andtheir enormous consequences. Given the fact that computer systems are ultimately
created by human hands, it is amazing how rarely they behave as we, their creators,
expect them to do. It must be the case that we do not quite understand computer
systems.
To understand the nature of computer systems is therefore a fundamental challenge
nowadays. This thesis is a step forward towards this goal. History tells us that clear
understanding of something is very often brought by mathematics, a lesson which weshall follow. That is, we aim at a mathematical theory of computer systems.

1.2

Coalgebras as systems

In this thesis coalgebras are employed to formulate diverse phenomena in computer
systems. Why coalgebras? We use them because the theory of coalgebras is one of
the most promising candidates for a mathematical foundation for computer systems,
equipped with both ample applicability and mathematical simplicity.
1

2

1

Introduction– Applicability. Our mathematical presentations of computer systems should be
able to address diverse (theoretical) problems in computer systems and theirsolutions.
– Simplicity. Inﬂuential work in mathematics is very often marked with its simplicity (or “beauty” as one may even say). Mathematical simplicity is a necessity for further development of a theory; it is also a source of abstraction whichbrings wide applicability.
Hopefully this thesis will provide grounds for the claim about such qualiﬁcations ofcoalgebras, through:– extending the application ﬁelds of coalgebras and demonstrating the notion’s
potential applicability; and– in each of the additional application ﬁelds, providing mathematically clear formulations of phenomena which have been identiﬁed as major obstacles in getting
computer systems right. In doing so we exploit mathematical simplicity of thenotion of coalgebras.
We begin with the deﬁnition of coalgebras (which is so simple) and then proceed tothe ﬁrst few examples that illustrate the idea “coalgebras as systems.”

1.2.1

Definition

The notion of coalgebras (co-algebras) is the categorical dual of that of algebras.
Hence one can say: the notion of coalgebras is as primitive as that of algebras.
1.2.1 Deﬁnition (Coalgebras). Let C be a category and F : C → C be an endofunctor. An F -coalgebra is a pair of an object X ∈ C (called its carrier ) and an arrow(its structure arrow )FX
cin C .
X
The functor F is called the coalgebra’s signature functor.
An F -coalgebra will be called simply a coalgebra when the signature functor F is
obvious from the context.
1.2.2 Remark (Functor coalgebras vs. Eilenberg-Moore coalgebras). The notionof coalgebras just introduced is sometimes called functor coalgebras, in contrast to
Eilenberg-Moore coalgebras for comonads (see e.g. [96]). It should be noted that
often in a categorical setting the latter notion is referred to (simply) as coalgebras
too. Throughout this thesis the word “coalgebra” is reserved for the former notion.

1.2.2

First examples

1.2

Coalgebras as systems

3⊇

In the last few decades, coalgebras have found their use{coalgebras}
as mathematical, categorical presentations of state-based
abstraction
systems such as automata; computer systems are also
instances of state-based systems. There are several in- {state-based systems}
troductory articles to the view of “coalgebras as state{computer systems}
based systems,” such as [65, 66, 86, 108, 114]; we refer tothem for a historical account of the ﬁeld, extensive investigation of examples, a list of references, and so on. Here we present a few small,elementary examples to provide an intuition.
Coalgebras are state-based systems. Let us take the category Sets of sets andfunctions as the base category C. This means that the objects (such as X and F X)care sets; and arrows (such as X → F X) are set-theoretic functions. As an endofunctor
F : Sets → Sets, let us take F = Σ × , that is
FX = Σ × X
where Σ is a ﬁxed set.
c
In this case, a coalgebra X → F X is identiﬁed with a function(a, x )Σ×X
cXsuch as.
x

The key idea is that we can think of– an element x ∈ X as a state, hence a set X as a state space;– an application of a function c as a one-step transition or dynamics.
Indeed, if c(x) is a pair (a, x ) as above, we can interpret its ﬁrst component a ∈ Σ
as the output of the state x when it makes a transition; its second component x ∈ X
as the next state of x. Therefore we can draw the following graphical representationof the coalgebra.
x

a

x

a

x

a

x

a

···

(1.1)

c

To summarize, a coalgebra X → Σ × X is a state-based system which, by making atransition, outputs a symbol in Σ and moves to another state.
c

Diﬀerent types of systems by diﬀerent endofunctor F . A coalgebra X →Σ × X (that we have just observed) denotes what is usually called a stream automaton:
its behavior—i.e. what we observe by continuously running the system—is an (inﬁnite)stream over the alphabet Σ, such as aa a a · · · in (1.1).

4

1

Introduction

Can we represent, as coalgebras, other kinds of state-based systems say labeledtransition systems (LTSs)? A state of LTSs has a set of possible transitions, each ofwhich is labeled with an element in a ﬁxed alphabet Σ.
x1
..
.
xn

a1
x
an

This is diﬀerent from stream automata in which a state has its unique output andsuccessor; an LTS exhibits non-deterministic branching. For a technical reason weshall focus on ﬁnitely branching LTSs in the sequel.1 This means that a state canhave only a ﬁnite number of possible outgoing transitions.
We can express such a system as a functionPﬁn (Σ × X)cXsuch as(a1 , x1 ), . . . , (ak , xk ),

xwhere Pﬁn denotes the operation of taking the set of all ﬁnite subsets:
Pﬁn X = {u ⊆ X | u is ﬁnite} .
Therefore (ﬁnitely branching) LTSs are coalgebras for the base category C = Sets
and the signature functor F = Pﬁn (Σ × ).
Non-deterministic automata are yet another kind of state-based systems. They
are almost the same as LTSs but each state has an additional 2-value attribute (Tor F) denoting whether it is one of the terminating states or not.2 Such systems
can be represented as coalgebras for C = Sets and now F = 2 × Pﬁn (Σ × ), where
2 = {T, F} is a 2-element set. For example,
2 × Pﬁn (Σ × X)cXsuch asT, {(a1 , x1 ), . . . , (ak , xk )}xa1, meaning

x
an

x1
..
.
xn

A much greater variety of systems allows representation as coalgebras using different functors F ; see e.g. [108].

1.3

Theory of coalgebras

We have sketched how state-based systems can be presented using the abstract notionof coalgebras. What do we gain from this presentation? Isn’t it just a fancy (or scary)
1 If we allow arbitrary degree of branching, a ﬁnal coalgebra (which we explain in Section 1.3)
does not exist due to the size problem. See e.g. [66].
2 We disregard the ﬁniteness conditions (on a state space X and on an alphabet Σ) which areusually present in the deﬁnition of non-deterministic automata.

1.3

Theory of coalgebras

5

way of presenting something one already knows, as if it were something one does notknow?
We claim that it is not the case. One ground for our claim is the following fact
(which has been recognized in the last couple of decades): some natural mathematicalconstructions on coalgebras have indeed important meanings in the theory of statebased systems. Among them, morphisms of coalgebras and the principle of coinduction—the two notions which we elaborate in this section—play important roles in thisthesis.

1.3.1

Morphisms of coalgebras as behavior-preserving maps

A morphism from one coalgebra to another is an arrow between their carriers which“preserves coalgebraic structures.”cd1.3.1 Deﬁnition (Morphisms of coalgebras). Let X → F X and Y → F Y be twocoalgebras (in the base category C). A morphism from the former coalgebra c to thelatter d is an arrow f : X → Y in C such that the following diagram commutes.
FX
c
X

Ff

(1.2)

FY
d
Y

f

F -coalgebras and morphisms between them form a category which we denote by
CoalgF . Therefore there is the following one-to-one correspondence:
 FY 
 FX 
f
c
−→ d
Y
X

in CoalgF
Fff

X −→ YFXcX

in C, such that

f

FY
d
Y

The signiﬁcance of morphisms of coalgebras is the fact that they represent behaviorpreserving maps between systems. To illustrate this point, let us take the setting inour ﬁrst example (C = Sets and F = Σ × ), in which case coalgebras are streamcdautomata. A morphism from X → Σ × X to Y → Σ × Y is a (set-theoretic) functionf

X → Y such that the diagram
Σ×X
c
X

Σ×f

f

Σ×Y
d
Y

6

1

Introduction

commutes. In order to examine what this commutativity means, let us denote thearrow c by
c = outc , nextc  : X −→ Σ × X ,making the two components outc : X → Σ and nextc : X → X explicit. Similarly wedenote d = outd , nextd . Then the above commutativity is obviously equivalent to
the following condition: for any “state” x ∈ X,
outc (x) = outd (f (x))

and f (nextc (x)) = nextd (f (x)) .

(1.3)
c

Its immediate consequence is that the “behavior” of a state x in the system X →d
F X coincides with that of f (x) in Y → F Y . Here by the “behavior” of x we meancthe inﬁnite stream over Σ that arises by running the system X → F X continuously,
starting from x.
x
f (x)

a

x

a

f (x )aaxf (x )

a
a

x
f (x )

a
a

···

in X → F X···

in Y → F Y

cdIndeed, the output a ∈ Σ of f (x) must be the same as that of x by the ﬁrst equalityaof (1.3); moreover, if x → x then the next state of f (x) must be f (x ) by the second
equality.
The slogan “morphisms of coalgebras as behavior-preserving maps” is true forother kinds of systems as well. For instance, for the other two examples of a signature functor F in Section 1.2.2 (namely functors for LTSs and non-deterministic
automata), the notion of coalgebra morphisms coincides with the usual notion offunctional bisimulation (i.e. functions whose graphs are bisimulation).

1.3.2

Behavior by coinduction

We just talked about an informal notion of behaviors of state-based systems. The
behavior of a system is what we “observe” by running a system. We shall take theblack-box view about our “observation”: we (as outside observers) observe the actions
executed by the system, but have no direct means of knowing which internal states
are realizing those actions.
Or rather, we do not want to care about the internal mechanisma•which realizes our (black-box) observation. In fact, identifying two
diﬀerent systems with the same behavior—such as the two streamaautomata on the right yielding the same stream aω —is often a very••
useful technique in veriﬁcation of state-based systems.
aOne of the nicest things about the abstract notion of coalgebras is that a notionof such “behaviors” can be elegantly formulated by a simple mathematical principleof coinduction, i.e. by ﬁnal coalgebras.

1.3

Theory of coalgebras7ζ

1.3.2 Deﬁnition (Final coalgebras, coinduction). A ﬁnal coalgebra Z → F Z is acﬁnal object in the category CoalgF .3 This means that, for any F -coalgebra X → F X,
there exists a unique morphism from c to ζ.
FX
c
X

Ff

f

FZ
ζ
Z

Making an explicit use of ﬁnality of a ﬁnal coalgebra is often referred to as the principleof coinduction.
1.3.3 Remark (Usage of “coinduction”). In [65] the word coinduction means theuse of the ﬁnality principle employed in a speciﬁc category CoalgF . We follow thisview.4 It is called co-induction because it is the categorical dual of induction which,in a categorical setting, refers to the use of the initiality principle for algebras.
Here are some typical usages of the word: the unique morphism f above is induced“by coinduction”; if g is another morphism from c to ζ then we conclude f = g“by coinduction.” Notice that ﬁnality—called coinduction in this setting—has two
separate aspects: existence of an arrow and its uniqueness. In fact, coinduction in
the former usage (exploiting the existence aspect) is sometimes called the coinduction
deﬁnition principle; coinduction in the latter usage (exploiting the uniqueness aspect)is called the coinduction proof principle.
Coinduction as a uniform mathematical principle that assigns to a system its
behavior is our principal tool in this thesis. The basic scenario is as follows. For thekind of state-based systems as speciﬁed by an endofunctor F ,– the set Z of all possible behaviors is itself found to carry an F -coalgebraic
ζstructure Z → F Z. It turns out that this ζ is a ﬁnal coalgebra.
c– Given an arbitrary coalgebra (i.e. a system) X → F X, there exists a uniquemorphism from c to ζ, by the deﬁnition of ﬁnal coalgebras.
FXcX

F (beh(c))

beh(c)

FZ
ζ
Z

(1.4)

The unique morphism thus induced is what assigns to (a state of) the coalgebrac its behavior, and is denoted by beh(c).
3 In category theory, a ﬁnal object is often referred to as a terminal object as well. Consequently,
a ﬁnal coalgebra is sometimes called a terminal coalgebra.
4 In computer science the word coinduction can be used in a diﬀerent, order-theoretic meaning,which refers to the use of greatest ﬁxed points. See e.g. [118]. In fact, our categorical usage is a
generalization of the other order-theoretic one, in the same way as categories are generalization ofpoet’s.

81

Introduction

It is illustrative to think of this scenario employed in the category Sets. Then thearrows are (set-theoretic) functions; the arrow beh(c) : X → Z is therefore a function
which carries each state x ∈ X to an element beh(c)(x) ∈ Z which is the “behavior”
cof the state x of the system X → F X.
This basic scenario works for a wide variety of systems, i.e. F -coalgebras for aζvariety of F . The notion of “behaviors” (represented by a ﬁnal F -coalgebra Z →F Z) varies according to the choice of a functor F . Furthermore, as we see later in
Chapter 2, coinduction can capture a diﬀerent kind of “behaviors” if employed in adiﬀerent category (than Sets). Let us look at some ﬁrst (standard) examples.
Coinduction for stream automata A stream automaton is an F -coalgebra for
F = Σ × in C = Sets. A natural notion of its “behavior” is the inﬁnite stream over
Σ that we observe by running the system continuously. The set of inﬁnite streams
over Σ (which we denote by Σω ) indeed carries the following F -coalgebra structure.
Σ × Σω
hd, tlΣω( a0 ,

a1 a2 a3 . . . )a0 a1 a2 . . .

Here the function hd returns the head element of a stream; the function tl returns thetail stream. Now it is not hard to prove the following.
1.3.4 Proposition (Coinduction for stream automata). Let C = Sets and F =cΣ × . For any F -coalgebra X → Σ × X, there exists a unique coalgebra morphism⎞⎛⎞⎛
Σ × Σω
Σ×X⎠  ⎝ hd, tl
⎠ .
⎝ c
X
Σω
In other words, there exists a unique function beh(c) : X → Σω that makes thefollowing coinduction diagram commute.
Σ×XcXΣ × beh(c)beh(c)

Σ × Σω
hd, tlΣω

(1.5)

The diagram is an instance of (1.4); hence the coalgebra hd, tl : Σω → Σ × Σω is aﬁnal coalgebra.
Commutativity of the diagram (1.5) can be rephrased into the following equations (aswe did in (1.3)). Recall that we write c = outc , nextc  : X → Σ × X.






(1.6)
hd beh(c)(x) = outc (x) and tl beh(c)(x) = beh(c) nextc (x) .

1.3

Theory of coalgebras

9

Putting it graphically,x → x
a

in

Σ×X
c
X

=⇒

beh(c)(x) = a a a a · ·· .
beh(c)(x )The equations (1.6) are therefore a natural deﬁnition of the inﬁnite stream (the “behavior”) beh(c)(x) induced by a state x of a stream automaton c, presented in aconventional manner. The coinduction diagram (1.5)—which is equivalent to theequations (1.6)—is a categorical presentation of the deﬁnition. Our point here is thatthe latter allows generalization to diﬀerent kinds of systems, due to the abstraction
inherent in category theory.
Coinduction for LTSs Coinduction as a mathematical principle for assigning a“behavior” can be applied also to (ﬁnitely branching) LTSs and non-deterministic
automata.
For the functor F = Pﬁn (Σ × )—for which a coalgebra is a ﬁnitely branching
LTS—a ﬁnal coalgebra indeed exists [4, 10]. In the sequel we shall sketch what it
looks like, without going too much into details.
First, the carrier set of the ﬁnal coalgebra—which we denote by STreeΣ∼ —consistsof equivalence classes of so-called synchronization trees over Σ, modulo bisimilarity.
– Synchronization trees [98] over Σ are ﬁnitely branching, (possibly) inﬁnite-depth
trees whose edges are labeled with elements of Σ, such as the following.

c
a
..
.

a

b

d

a
c
..
.

b
..
.

b
a
..
.

d

b
..
.

The nodes after d-edges (without any successors) are understood to have thebranching degree 0.
– Bisimilarity is one of the standard notions of process equivalence, originallyintroduced in [107]. We shall denote the bisimilarity equivalence (on synchronization trees) by ∼.
A synchronization tree emerges when we “unfold” an LTS and depict the possible
execution paths of the LTS, starting from a speciﬁc state. For example, the above
synchronization tree arises by unfolding the following LTS, starting from the state x.
a
b

y

x
c

d

z

10

1 Introduction

The structure arrow of the ﬁnal coalgebra—which we denote by dstr—is the following one, “destructing” a tree into its immediate subtrees.
STreeΣ
∼a1 • an

⎡
⎢
⎣
t1

···

tn

dstr

⎤

−→

⎥
⎦

−→

Pﬁn (Σ × STreeΣ∼)(a1 , [t1 ]∼ ), . . . , (an , [tn ]∼ )∼One can prove that this function dstr is well-deﬁned, because of the deﬁnition ofbisimilarity ∼.
Now, the following coinduction diagram in Sets is an instantiation of (1.4) in thecurrent LTS setting.
Pﬁn (Σ × X)cPﬁn (Σ × beh(c))

Xbeh(c)

Pﬁn (Σ × STreeΣ∼)
dstr
STreeΣ
∼(1.7)

In this way a ﬁnitely branching LTS (represented by a coalgebra c) is assigned its“behavior” beh(c) : X → STreeΣ∼ . The commutativity of the diagram (1.7) boils
down to the following condition.
⎤⎡
a1 • an⎥⎢a1 x an⎥⎢in the system c =⇒ beh(c)(x) = ⎢
⎥
⎦
⎣
x1
xn
···
·
·
·
beh(c)
beh(c)
(x1 )

(xn )

∼

Therefore the “behavior” beh(c)(x) ∈ STreeΣ∼ is (the equivalence class of) the unfolding of the LTS c, starting from the state x. The following points should be noted
here.
– Information on internal states (x, x1 , x2 , . . . ) is not present in the behavior,because in a synchronization tree nodes are not labeled.
– Moreover, two states which are bisimilar (according to the standard deﬁnition)Σare mapped to the same element of STreeΣ∼ , because elements of STree∼ areequivalence classes modulo ∼.
Therefore we have illustrated the following result.
1.3.5 Proposition (Coinduction captures bisimilarity). There exists a ﬁnal coalgebraΣdstr : STreeΣ∼ −→ Pﬁn (Σ × STree∼ )for the functor Pﬁn (Σ × ) on Sets.

1.3

Theory of coalgebras

11

Moreover, the equivalence relation induced by coinduction coincides with the usualcnotion of bisimilarity. That is, if x ∈ X is a state of a coalgebra X → Pﬁn (Σ × X)dand y ∈ Y is a state of Y → Pﬁn (Σ × Y ), then we havebeh(c)(x) = beh(d)(y)⇐⇒in STreeΣ∼x and y are bisimilar .

We refer to the second point of the proposition as: coinduction captures bisimilarity;
or a ﬁnal coalgebra is fully abstract with respect to bisimilarity.
Coinduction in Sets captures bisimilarity It turns out that the last point in theprevious paragraph “coinduction captures bisimilarity” holds not only for the speciﬁc
endofunctor F = Pﬁn (Σ × ), but also for a variety of endofunctors F on Sets.
Speciﬁcally, for an arbitrary endofunctor F : Sets → Sets (i.e. for systems otherthan LTSs) we can deﬁne the generalized notion of bisimulations using suitable spans.
Besides this categorical formulation of bisimulations, the notion of bisimilarity also
arises categorically, as the universal one among all the bisimulations. It can be shown(see e.g. [114]) that this generic notion of bisimilarity is captured by coinduction (inthe sense of Proposition 1.3.5), if the functor F preserves weak pullbacks, a condition
satisﬁed by most functors on Sets of our interest.
Therefore here comes another slogan: coinduction in Sets captures bisimilarity.
Note that, although this slogan is valid for a variety of endofunctors F , the basecategory C is ﬁxed to be Sets. In Chapter 2 we will see that trace equivalence—
another standard process equivalence which is coarser than bisimilarity—is captured
by coinduction in a diﬀerent universe, namely in a Kleisli category instead of in Sets.
1.3.6 Example (Non-deterministic automata). Our arguments on the ﬁnal coalgebra
for the functor F = Pﬁn (Σ × ) (modeling ﬁnitely branching LTSs) remain valid
if we consider the functor F = 2 × Pﬁn (Σ × ) (modeling ﬁnitely branching nondeterministic automata).
The ﬁnal coalgebra for F = 2 × Pﬁn (Σ × ) consists of synchronization trees—
whose nodes are now labeled by T or F—modulo a suitable notion of bisimilarity.
The following is an example of such a synchronization tree.
ab : labeled by T,
i.e. a terminating state : labeled by F,i.e. a non-terminating state

c
a

c

c b
c
a
..
..
..
..
.
.
.
.
This tree arises by unfolding the following non-deterministic automaton starting fromthe state x. In other words, the state x’s “behavior” assigned by coinduction is theabove tree (modulo bisimilarity).
a
..
.

a
c

y

x
b

12

1 Introduction

One thing to note here is that bisimilarity (captured by coinduction) is diﬀerent fromlanguage equivalence, another standard notion of equivalence for non-deterministic
automata. A state of a non-deterministic automaton determines a subset of the setΣ∗ of words in Σ, called its accepted language—(ab + c)∗ for the state x in the above
example. Two states of non-deterministic automata are language equivalent if theiraccepted languages are the same.
Language equivalence is as a relation strictly coarser than bisimilarity, as the following classic example of “language equivalent but not bisimilar states” demonstrates(see e.g. [129]).
x
b

x

a

a
c

a
(1.8)
c

b

Indeed, the two states x and x have the same accepted language {ab, ac}; but x
cannot simulate x’s ability that “after making an a-move, the system can still choose
between b- and c-moves,” which makes x not bisimilar to x . How to capture this notion of language equivalence by coinduction—besides bisimilarity—will be our theme
in Chapter 2.

1.4

Thesis outline

The following table summarizes the correspondence we have observed, between coalgebraic constructs and basic concepts in the theory of computer systems.

coalgebraicallysystemcoalgebra

behavior-preserving map
morphism of coalgebras

FX

FX

X

X

Ff

f

FY

behaviorby coinduction
FX
FZ

Y

X

c

ﬁnal
beh(c)

Z(1.9)

The examples so far have been accommodated in the category Sets, where the “behavior” captured by coinduction coincides with bisimilarity.
This thesis selects some noted phenomena in computer systems and provides clear
understanding of them, by identifying fundamental mathematical structures hidden
behind. Our mathematical formulations of those phenomena are based on coalgebras;thus this thesis extends the (existing) theory of coalgebras (such as table (1.9)) inseveral directions.
Let us now take a brief look at the issues about computer systems that we willaddress in later chapters. In each chapter, we focus on one speciﬁc issue.

1.4

Thesis outline

13

Chapter 2. Trace semantics via coinduction We have seen that coinduction in
Sets captures a “behavior” modulo bisimilarity. However, there are standard notionsof behavioral equivalence other than bisimilarity, such as language equivalence for nondeterministic automata. So one may ask: can we capture other notions of equivalencealso by coinduction?
In Chapter 2 we present a partial, yet positive answer to this question. We present
a coalgebraic framework for capturing trace semantics; language equivalence is an
instance of trace semantics. Informally speaking, the diﬀerence from bisimilarity
is the fact that in trace semantics inner branching structures are abstracted away;see (1.8).
Our contributions are summarized as follows.
– Trace semantics via coinduction in K(T ) We identify coinduction in a
Kleisli category K(T ) as a mathematical principle for capturing trace semantics.
That is, the coinduction diagram in K(T )FXcX

F (beh(c))

beh(c)FZ
ζZ

yields an arrow beh(c) which assigns to each state x ∈ X its trace semantics.
Therefore the theory of coalgebras, when employed in K(T ), can be thought ofas the theory of state-based systems “modulo trace semantics.” Intuitively, itis the use of K(T ) as the base category which abstracts away inner branching
structures.
– Identiﬁcation of a ﬁnal coalgebra in K(T ) A ﬁnal coalgebra in K(T ) turns
out to coincide with an initial algebra in Sets for the corresponding endofunctor.
This (seemingly surprising) technical result follows from• a suitable adjunction lifting which lifts an initial algebra in Sets to an
initial algebra in K(T ); and• the initial algebra-ﬁnal coalgebra coincidence in K(T ) which results fromthe limit-colimit coincidence due to a suitable order-enriched structure ofK(T ).
Here we gain remarkable genericity by using abstract categorical terms. Noticethat the framework has a parameter T —a monad on Sets—which in fact speciﬁes
the type of branching. For one choice, systems have non-deterministic branchingas in LTSs; for another choice systems come to have probabilistic branching. The
coinduction framework works also in the latter setting, which enables us to capture“trace semantics” for probabilistic systems, such as the following. For the state x of

14

1 Introduction

the probabilistic systemxa[ 13 ]a[1]z

a[ 13 ]
1
3

a[ 12 ]y12



“trace semantics” is the probability (sub)distribution → 13 , a → 13 · 12 , a2 → 13 · 12 · 12 ,n
an → 13 · 12 , · · ····that tells the probability with which the word an occurs before the system hits thetermination symbol .
To summarize, this chapter extends the application ﬁelds of coalgebras by adding
trace semantics to the list of process semantics that are captured by coinduction.
From a diﬀerent point of view, “trace semantics” (for various kinds of systems, suchas non-deterministic vs. probabilistic) is given a uniform mathematical description,
namely as coinduction in a Kleisli category.
The material in Chapter 2 is based on joint work [43, 44, 47] with Bart Jacobs
and Ana Sokolova. Useful comments from Jiřı́ Adámek, Chris Heunen, Stefan Milius,
Tarmo Uustalu and the anonymous referees of these papers are gratefully acknowledged.
Chapter 3. Generic forward and backward simulations In this chapter wecontinue our investigation into coalgebras in a Kleisli category K(T ). We have shownthat coinduction in K(T ) gives trace semantics. What about the other coalgebraic
constructs in the table (1.9), namely morphisms of coalgebras? How can we interpretthem in K(T )?
It turns out that two relaxed versions of morphisms of coalgebras—lax and oplax
morphisms—have signiﬁcant meanings in the study of computer systems, namely as
forward and backward simulations between systems.
FX
c
X

Ff

FY
d
Y

f
lax coalgebra morphism= forward simulation

FX
c
X

Ff


FY
d
Y

f
oplax coalgebra morphism= backward simulation(1.10)The partial order  in the diagram refers to the natural notion of “more behavior” associated with the branching type in question—such as set inclusion for nondeterministic branching. Therefore this chapter, combined with the previous Chapter 2, establishes the view of the theory of coalgebras in K(T ) as the generic theoryof traces and simulations.

1.4

Thesis outline

15

The theory of traces and simulations has been extensively studied due to its significance in system veriﬁcation; see e.g. [94]. A typical application scenario that involves
traces and simulations is as follows.
– We have two systems at hand, S (called a speciﬁcation) and I (called an implementation).
– The speciﬁcation S is a simple system and is known to satisfy a certain desired
property P . Let us assume that P is a safety property, meaning: a certain(unwanted) phenomenon never occurs in any execution trace of the system.
Our goal is to establish that the implementation system I also satisﬁes thesafety property P .
– To that goal, it suﬃces for us to show
(trace semantics of I)  (trace semantics of S) ,(1.11)

which means for example that the former trace set is included in the latter(when systems are non-deterministic). Indeed, since we already know that noneof the execution traces of the speciﬁcation system S exhibits the unwanted
phenomenon, from the above “trace inclusion” (1.11) we can conclude thatneither the implementation I exhibits the unwanted phenomenon. Hence I isshown to satisfy the safety property P .
– In order to show the trace inclusion (1.11), we search for either a forward
or a backward simulation from I to S. We do so because traces and forward/backward simulations are related via a so-called soundness theorem: for
two systems X and Y,∃ (forward or backward simulation from X to Y)=⇒(trace sem. for X )  (trace sem. for Y) .

In this way we prove I’s satisfaction of the trace-based property P , essentially byﬁnding a simulation. Such a simulation-based method is often useful because, inmany applications, establishing trace inclusion (1.11) by directly computing the trace
semantics (which takes arbitrarily many steps into account) is much harder thanchecking that a relation forms a forward/backward simulation (which only involves
one-step transitions).
Therefore the soundness theorem—relating simulations and trace semantics—isan essential piece in the theory of traces and simulations. Indeed, our main result inthis chapter is a generic soundness theorem which relates coalgebraic trace semantics(via coinduction, Chapter 2) and coalgebraic forward/backward simulations in (1.10).
It is proved once for all, using abstract categorical terms.
Here again we gain ample genericity by using abstract categorical terms. In particular, the framework covers both non-deterministic systems and probabilistic ones.
Assume that we are interested in some (exotic) kind of systems, no matter if they
are non-deterministic or probabilistic. When those systems allow suitable coalgebraic

16

1 Introduction

modeling (which happens reasonably often), our coalgebraic framework provides a
deﬁnition of forward/backward simulations tailored for this kind of systems as an
instantiation of (1.10). This deﬁnition is guaranteed to be a “useful” one, because forthis deﬁnition of simulations the soundness theorem comes for free.
From a viewpoint of a coalgebra-theorist, in Chapters 2 and 3 we have establishedthe view:
theory of coalgebras in a Kleisli categoryasgeneric theory of traces and simulations
which is summarized in the following table of correspondences.
systemin K(T )coalgebra

simulation
forwardbackwardlax morphism
oplax morphism

FX

FX

X

X

Ff

f

FY

FX

Y

X

Ff

f

trace semantics

FY

coinduction
FX
FZ

Y

X

c

ﬁnal
beh(c)

Z(1.12)

This is a new way of understanding the basic table (1.9), besides the standard one(namely, coalgebras in Sets are systems modulo bisimilarity). In this way we haveextended the application ﬁelds of coalgebras.
The material in Chapter 3 has been presented in [46]. Part of the work was done
during the author’s stay at Research Center for Veriﬁcation and Semantics, National
Institute of Advanced Industrial Science and Technology (AIST), Japan, in March
2006. Their hospitality as well as helpful comments from Chris Heunen, Bart Jacobs,
Yoshinobu Kawabe, Koki Nishizawa, Ana Sokolova, Frits Vaandrager and Hiroshi
Watanabe are gratefully acknowledged.
Chapter 4. Probabilistic anonymity (case study) The table (1.12) summarizes the view of theory of coalgebras in K(T ) as theory of traces and simulations. As
already mentioned, what is remarkable in this table is the fact that non-deterministic
systems and probabilistic systems are given the same, uniform treatment. In particular, the shift from non-deterministic branching to probabilistic one is just a matterof replacing the parameter T . That is to say, anything we can (coalgebraically) do ina non-deterministic setting, we can also do in a probabilistic setting (by replacing T ).
We will exploit this genericity in this chapter which is devoted to a case study ofverifying anonymity properties of network protocols. Online anonymity is an increasingly important property, at this age when most human activities involve communication on the Internet. Advances in information communication technology have madeexchange of enormous amount of information a daily matter, from which we beneﬁtvastly. However, it is the same technology that poses threats to our privacy: so muchinformation on us is on the Internet and retrieving it has never been an easier task.

1.4

Thesis outline

17

Therefore formalization and veriﬁcation of anonymity properties have attracted
increasing attention in the computer security community. In this chapter we set ourstarting point at one deﬁnition of anonymity introduced in [119]—as a property ofthe trace set of an automaton—and a simulation-based proof method [71, 72] forthis notion of anonymity. These prior results are all obtained in a non-deterministic
setting.
However, an important role of probability has been claimed recently by many authors in the ﬁeld. Non-deterministic anonymity is qualitative: each participant of
the protocol is either “suspicious” or “not suspicious at all,” but nothing in between.
In contrast, in a probabilistic notion of anonymity we talk about quantitative suspicion, a fact which is essential in modeling e.g. those anonymizing protocols which use
probabilistic mechanisms for disguising identities.
The main contribution in this chapter is hence transferring the non-deterministic
simulation-based proof method for anonymity—introduced in [71, 72]—to a probabilistic setting. In its course we fully exploit the coalgebraic theory developed inprevious chapters: we obtain the deﬁnition of suitable “probabilistic simulations” byinstantiating the coalgebraic deﬁnition and the soundness theorem (which comes forfree) plays an essential part in the proof method.
The material in Chapter 4 is based on joint work [50, 51] with Yoshinobu Kawabeand Hideki Sakurada, carried out during the author’s stay at NTT Communication
Science Laboratories in September–October 2006 and April 2007. Helpful commentsfrom Kostas Chatzikokolakis, Tom Chothia, Ken Mano, Catuscia Palamidessi, Petervan Rossum, Ana Sokolova, Yasuaki Tsukada and the anonymous referees for thepaper [50] are gratefully acknowledged.
Chapter 5. Concurrency and the microcosm principle (foundational study)
In this chapter we address the issue of concurrency in computer systems. Concurrency is about running multiple systems in parallel, possibly involving communication
between them. Concurrency is everywhere at this age when almost all the computers are mutually connected via the Internet. At the same time, the exponentiallygrowing complexity of systems with concurrency makes veriﬁcation of such systems afundamental challenge in computer science.
Our special attention is to the compositionality property: informally it means thatthe behavior of a composed system C  D is determined by the behavior of C and thatof D. The signiﬁcance of compositionality in the study of computer systems is thatit supports modular veriﬁcation methods. In modular veriﬁcation, correctness of acomposed system C1  · · ·  Cn is established using correctness of each component Ci .
We start with the following—seemingly plausible—formulation of “coalgebraic
compositionality.” The operator beh is the one induced by coinduction; see (1.9).
 FY 
 FX  FY  FX  beh c  d
= beh c beh dY
X
Y
X

(1.13)

18

1 Introduction

However, a closer look at the equation raises some questions. Most notably, the two
operators  on each side of the equation have in fact diﬀerent domains: the one on
the left has a type

CoalgF × CoalgF −→ CoalgF ,composing coalgebras as systems;

while the one on the right has a type

Z × Z −→ Z ,composing “states” of the ﬁnal coalgebra Z as behaviors.

Moreover, these two domains (CoalgF and Z) are nested: the latter is an object of
the former (which is a category). Therefore what we observe here is a phenomenon
that the same algebraic structure—namely a binary operator  possibly with someequational properties such as associativity—interpreted in two separate yet nested
domains. This is the mathematical structure of our interest in this chapter.
Although examples of such phenomena abound in computer science—think ofconcatenation of deterministic automata and of regular languages—there does notseem to be much emphasis on them. However in mathematics the phenomenon ofsuch nested algebraic structures has been long known; it is called the microcosm
principle by Baez and Dolan [9]. We take this abstract, mathematical principle initself as an interesting topic to investigate.
In this chapter—starting with the above observation on paral1
lel composition and compositionality—we present a mathematicallyrigorous formalization of the microcosm principle. The formaliza- L ⇓X CAT
Ction is 2-categorical and looks like the diagram on the right. An
algebraic theory to be interpreted twice is presented categorically as a Lawvere theory
L; an outer model (the category CoalgF in the above example) is a product-preserving
functor C; and an inner model (the object Z above) is a lax natural transformation
X. Here 1 denotes the constant functor into the category 1 with one object and one
arrow.
Based on this formalization, we turn our attention back to coalgebraic settings. As
our main result we prove a generic compositionality result regarding an L-structure
on coalgebras, for an arbitrary algebraic theory L. This generic result instantiates
to the equation (1.13) when L is suitably chosen. Therefore our expedition in thischapter establishes mathematical foundation for modular veriﬁcation of systems withconcurrency.
Additionally, we investigate the relationship between the general framework forparallel composition (in this chapter) and the material in the previous chapters: theformer indeed yields “compositionality” results for trace semantics and simulations.
Speciﬁcally, our main result in this chapter (generic compositionality for behavior bycoinduction) immediately yields compositionality of trace semantics which is “behavior by coinduction” in K(T ) (Chapter 2). Moreover, in relation to coalgebraic simulations (Chapter 3), we show that the forward/backward similarity relations are compositional under suitable assumptions. Let us write c F d (“c is forward-simulated

1.5

Information for reading

19

by d”) if there exists a forward simulation from a coalgebra c to another d. Then we
have






FX
FX  FVFY  FV
FY
c
c 
F d
=⇒
F
.
d 
e
e
V
V
X
X
Y
Y
We obtain a similar result for backward similarity as well.
We consider the material in Chapter 5 as a starting point of our research programon concurrency in coalgebra. The material is based on joint work [45] with Bart
Jacobs and Ana Sokolova. Helpful comments from Kazuyuki Asada, John Baez,
Masahito Hasegawa, Bill Lawvere, Duško Pavlović, John Power and the participantsof CALCO-jnr workshop including Alexander Kurz are gratefully acknowledged.

1.5

Information for reading

Chapters 2–4 form a single thread, investigating coalgebras in a Kleisli category andapplying them in a case study. The topic of Chapter 5 is outside this thread; although we also describe a relationship to earlier chapters, Chapter 5 can be read as
an independent material.
This thesis contains no more introductory treatment of the standard theory of
coalgebras than we have already had. See [65, 66, 86, 108, 114] for more details.
Nor have we any introductory material for basic category theory. For Chapters 2
and 3, the needed categorical background is available from the references at eachpoint or from one of the aforementioned standard references on coalgebras. Chapter 4
does not have many prerequisites as it is a case study. Chapter 5 is mathematicallymore demanding compared to the previous chapters. Although it is meant to be
self-contained, the reader may feel more comfortable being familiar with monoidal
categories [96, Chapter VII]; Lawvere theories [82]; and with basic higher-dimensional
category theory [19, Chapter 7].

20

1 Introduction

Chapter 2
Trace semantics via coinduction

Trace semantics has been deﬁned for various kinds of state-based systems, notably
with diﬀerent forms of branching such as non-determinism vs. probability. In thischapter we claim to identify one underlying mathematical structure behind these“trace semantics,” namely coinduction in a Kleisli category. This claim is based on
our technical result that, under a suitably order-enriched setting, a ﬁnal coalgebra ina Kleisli category is given by an initial algebra in the category Sets. Formerly thetheory of coalgebras has been employed mostly in Sets where coinduction yields aﬁner process semantics of bisimilarity. Therefore we extend the application ﬁelds ofcoalgebras, providing a new instance of the principle “process semantics via coinduction.”

2.1

Overview

Trace semantics is a commonly used semantic relation for reasoning about state-based
systems. Trace semantics for labeled transition systems is found on the coarsest edgeof the linear time-branching time spectrum [39]. Moreover, trace semantics is deﬁned
for a variety of systems, among which are probabilistic systems [122]. Our claim in
this chapter is: these various forms of “trace semantics” are instances of a general
construction, namely coinduction in a Kleisli category.
21

22

2 Trace semantics via coinduction

2.1.1“Trace semantics” in various contexts

First we motivate our contribution through examples of various forms of “trace semantics.” Think of the following three state-based, branching systems.

x

a

y

b

a[ 13 ]xa[ 13 ]



y
1
2

1
3

z
a[1]

a[ 12 ]

A context-free grammar(for Peano Arithmetic)
Terminal symbols:
Non-terminal symbol:
Generation rules:
T→0
T → sT0, s
T (2.1)– The ﬁrst one is a non-deterministic system with a special state  denoting
successful termination. To its state x we can assign its trace set:
tr(x) = {a, ab, abb, . . . } = ab∗ ,(2.2)

that is, the set of the possible linear-time behaviors (namely words) that canarise through an execution of the system.1 In this case the trace set tr(x) is
also called the accepted language; formally it is deﬁned (co)recursively by thefollowing equations. For an arbitrary state x,
 ∈ tr(x)a · σ ∈ tr(x)

⇐⇒
⇐⇒

x→
a
∃y. ( x → y ∧ σ ∈ tr(y) )(2.3)

Here  denotes the empty word; σ = a1 a2 . . . an is a word.
– The second system has a diﬀerent type of branching, namely probabilistica[1/3]

branching. Here x −→ y  denotes: at the state x , a transition to y  which
outputs a occurs with probability 1/3. Now, to the state x , we can assign its
trace distribution:
 → 13 , a → 13 · 12 , a2 → 13 · 12 · 12 , · · ·tr(x) =,
(2.4)
nan → 13 · 12 , · · ·that is, the probability distribution over the set of linear-time behaviors.2 Its
formal (corecursive) deﬁnition is as follows.
tr(x)() = Pr(x → ) ,atr(x)(a · σ) =y∈X Pr(x → y) · tr(y)(σ) ,(2.5)

where Pr(. . . ) denotes the probability of a transition.
1 The inﬁnite trace abω is out of our scope here: we will elaborate this point later in Section 2.4.2.
2 Here again, we do not consider the inﬁnite trace aω → 1/3.

2.1

Overview

23– The third example can be thought of as a state-based system, with non-terminal
symbols as states. It is non-deterministic because a state T has two possible
transitions. It is natural to call the following set of parse-trees its “trace semantics.”
⎧
⎫
•
•
⎨ •
⎬
0 s
s
•
•
tr(T) =
·
·
·
0
s
•
⎩
⎭
0
It is again a set of “linear-time behaviors” as in the ﬁrst example, although thenotion of linear-time behaviors is diﬀerent here. Linear-time behaviors—that
is, what we observe after we have resolved all the non-deterministic branchingsin the system—are now parse-trees instead of words.
2.1.1 Remark. Notice that the ﬁrst system in (2.1) can be thought of as a (ﬁnitely
branching) non-deterministic automaton as described in Chapter 1. This is by identifying states which have a transition to termination , with terminating states  innon-deterministic automata. That is,
a1

..
.

x


x1

an

a1
if and only if

..
.

x
an

xn

x1
.

(2.6)

xn

We will come back to this point later in Remark 2.2.2.

2.1.2

Coalgebras and coinduction

In recent years the theory of coalgebras has emerged as the “mathematics of statebased systems” [65, 66, 114]. In the categorical theory of coalgebras, an importantdeﬁnition/reasoning principle is coinduction: a system (identiﬁed with a coalgebrac : X → F X) is assigned a unique morphism beh(c) into a ﬁnal coalgebra.
FXcX

F (beh(c))

beh(c)

FZ∼ ﬁnal=Z

The success of coalgebras is largely due to the fact that, when Sets is taken as the basecategory, ﬁnal coalgebra semantics is fully abstract with respect to the conventionalcdnotion of bisimilarity: for states x and y of coalgebras X → F X and Y → F Y ,beh(c)(x) = beh(d)(y)⇐⇒x and y are bisimilar.

This is the case for a wide variety of systems (i.e. for a variety of functors F ), hence
coinduction in Sets captures bisimilarity.

24

2 Trace semantics via coinduction

However, there is not so much work so far that captures other behavioral equivalences (coarser than bisimilarity) by the categorical principle of coinduction. The current work—capturing trace semantics by coinduction in a Kleisli category—therefore
extends the application ﬁelds of the theory of coalgebras.

2.1.3

Our contributions

Our technical contributions are summarized as follows. Assume that T is a monadon Sets which has a suitable order structure; we shall denote its Kleisli category byK(T ).
– Trace semantics via coinduction in a Kleisli category. Commutativity of thecoinduction diagram
F (tr(c))
FX
c
X

tr(c)

FZ
∼ ﬁnal=Z

inK(T ),
the Kleisli category for T(2.7)

is shown to be equivalent to the conventional recursive deﬁnition of trace semantics such as (2.3) and (2.5). This is true for both trace set semantics (fornon-deterministic systems) and trace distribution semantics (for probabilistic
systems). The induced arrow tr(c) thus gives (conventional) trace semantics fora system c.
– Identiﬁcation of a ﬁnal coalgebra in a Kleisli category. We show thatan initial algebra in Sets
coincides witha ﬁnal coalgebra in K(T ).
In particular, a ﬁnal coalgebra in Rel is an initial algebra in Sets, because thecategory Rel of sets and relations is a Kleisli category for a suitable monad.
This coincidence happens in the following two steps:• an initial algebra in Sets lifts to an initial algebra in a Kleisli category,due to a suitable adjunction-lifting result;• in a Kleisli category we have initial algebra-ﬁnal coalgebra coincidence.
Here we use the classical result by Smyth and Plotkin [127], namely limitcolimit coincidence which is applicable in a suitably order-enriched category.
Note the presence of two parameters in (2.7): a monad T and an endofunctor F , bothon Sets. The monad T speciﬁes the branching type of systems. We have three leading2.1

Overview

25

examples:3– the powerset monad P modeling non-deterministic or possibilistic branching;– the subdistribution monad D
DX = {d : X → [0, 1] |"d(x) ≤ 1}x∈X

modeling probabilistic branching; and– the lift monad L = 1 + ( ) modeling system with exception (or deadlock, nontermination).
The functor F speciﬁes the transition type of systems: our understanding of “transition type” shall be clariﬁed by the following examples.
– In labeled transition systems (LTSs) with explicit termination—no matter ifthey are non-deterministic or even probabilistic—a state either• terminates (x → ), ora• outputs one symbol and moves to another state (x → x ),in one transition. This “transition type” is expressed by the functor F X =1 + Σ × X, where Σ is the output alphabet and 1 = {}.
– In context-free grammars (CFGs) as state-based systems, a state evolves into
a sequence of terminal and non-terminal symbols in a transition. The functor
F X = (Σ + X)∗
with Σ being the set of terminal symbols, expresses this transition type.
Clear separation of branching and transition types is essential in our generic treatmentof trace semantics. The transition type F determines the set of linear-time behaviors(which is in fact given by an initial F -algebra in Sets). We model a system by accoalgebra X → F X in the Kleisli category K(T )—see (2.7)—where F is a suitable
lifting of F in K(T ). By the deﬁnition of a Kleisli category we will easily see thefollowing bijective correspondence.
X
X

c
c

F X in K(T )T F X in Sets

Hence our system—a function of the type X → T F X—ﬁrst resolves a branching oftype T and then makes a transition of type F . Many branching systems allow such
representation so that our generic coalgebraic trace semantics applies to them.
3 Other examples include the monad X → (N ∪ {∞})X for multisets, the monad X → [0, ∞]X
for real valuations, and the monad X → P(M × ) with a monoid M for timed systems (cf. [75]).
These monads can be treated in a similar way as our leading examples. We leave out the details.

26

2 Trace semantics via coinduction

2.1.4

Testing and trace semantics

Since the emergence of the theory of coalgebras, the signiﬁcance of modal logics as
speciﬁcation languages has been noticed by many authors. This is exempliﬁed by
the slogan in [85]: ‘modal logic is to coalgebras what equational logic is to algebras’.
Inspired by coalgebras on Stone spaces and the corresponding modal logic, recent
developments [17, 18, 79, 80, 83, 87, 109] have identiﬁed the following situation as theessential mathematical structure underlying modal logics for coalgebras.

F op

Cop

P

S op

A

M

together withδ

M P =⇒ P F op

In fact, it is noticed in [109] that such a situation not only hosts a modal logic but
also a more general notion of testing (in the sense of [39, 130], also called testing
scenarios). Therefore we shall call the above situation a testing situation.
In the last technical section of the chapter we investigate coalgebraic trace semantics for the special case T = P (modeling non-determinism) from this testing pointof view. First, we present some basic facts on testing situations, especially on therelationship between the induced testing equivalence and ﬁnal coalgebra semantics.
These two process equivalences are categorically presented as kernel pairs, which enables a fairly simple presentation of the theory of coalgebraic testing. In addition,
we observe that the coinduction scheme in the Kleisli category K(P) gives rise to a
canonical testing situation, in which the set of tests is given by an initial F -algebra.

2.1.5

Organization of the chapter

In Section 2.2 we observe that a coalgebra in a Kleisli category is an appropriate “denotation” of a branching system, when we focus on trace semantics. In Section 2.3 wepresent our main technical result that an initial algebra in Sets yields a ﬁnal coalgebra in K(T ). The relationship to axiomatic domain theory—which employs similarmathematical toolkit—is also discussed here. Section 2.4 presents some examples of
the use of coinduction in K(T ) and argues that the coinduction principle is a generalform of trace semantics. In Section 2.5 we review the preceding material from thetesting point of view.

2.1.6

Bibliographical remarks

Capturing trace semantics via coinduction is the central theme of this chapter. Oneof the ﬁrst attempts to do so is in [116], which focuses on (non-deterministic) labeledtransition systems. The use of the Kleisli category K(P) to accommodate nondeterministic systems is claimed in [111] and pursued in [62]. We follow this idea.
In [111] they also present a scheme to lift a functor from Sets to a Kleisli category via
a distributive law. Their scheme constitutes a part of ours presented in Section 2.2.2.

2.2

Coalgebras in a Kleisli category

27

Talking about distributive laws, there is another separate line of studies in thetheory of coalgebras which utilize distributive laws. It is about bialgebras, concerning
about process terms as algebras, transition systems as coalgebras, and structuraloperational semantics—specifying how algebra meets coalgebra—expressed in termsof distributive laws. The seminal paper [134] commences this line of work (althoughsome ideas already appear in [116]), later followed by [12, 67, 75, 78, 79]. The material
later in Chapter 5 can be also seen as a further development along this line.
In this chapter the main technical ingredient that leads to identiﬁcation of a ﬁnal coalgebra in K(T ) is the theory of algebras and coalgebras in order-enrichedcategories. Originally it is used in the domain-theoretic semantics of programming
languages, such as in [31, 34, 35, 106, 125, 127]. Besides, identiﬁcation of an initial
algebra and a ﬁnal coalgebra in Rel ∼= K(P)—which is a special case of our general
result—has played an important role in relational reﬁnement calculus to reason aboutprograms involving algebraic data types [16, 101]. Relations to these references aredescribed in detail later in Section 2.3.3–2.3.4.

2.2

Coalgebras in a Kleisli category

In the study of coalgebras as “categorical presentations of state-based systems,” thecategory Sets of sets and functions has been traditionally taken as a base category(see e.g. [65, 114]). An important fact in such a setting is that bisimilarity is often
captured by coinduction.4
However, bisimilarity is not the only process equivalence. In some applications
one would like coarser equivalences, for example in order to abstract away internalbranching structures. One of such coarser semantics, which has been extensively
studied, is trace equivalence. Trace equivalence appeared in Chapter 1 as language
equivalence of non-deterministic automata. Another example is in the process algebra
CSP [55] where trace semantics is used as an operational model. Trace equivalence
is coarser than bisimilarity, as the classic example (1.8) of “trace-equivalent but notbisimilar” states demonstrates.
It is ﬁrst noticed in [111] that the Kleisli category for the powerset monad is anappropriate base category for trace semantics for non-deterministic systems. Thisobservation is pursued further in [43, 44, 47, 62]. In [42] it is recognized that the sameis true for the subdistribution monad for probabilistic systems. The current chapterof this thesis provides a uniﬁed framework which yields those preceding results, interms of Cppo-enrichment of a Kleisli category; see Section 2.2.3. In this section weﬁrst aim to justify the use of coalgebras in a Kleisli category.
4 Non-examples include LTSs with unbounded branching degree; this is why we exclusively considered ﬁnitely branching systems in the introduction (Chapter 1). LTSs are modeled as coalgebras
for F X = P(Σ × X)—using P instead of Pfin . Lambek’s Lemma readily shows that this choice of∼= P(Σ × Z)
F does not have a ﬁnal coalgebra in Sets, because it would imply an isomorphism Z →which is impossible for cardinality reasons.

28

2 Trace semantics via coinduction

2.2.1

Monads and Kleisli categories

Here we recall the relevant facts about monads and Kleisli categories. For simplicity
we exclusively consider monads on Sets.
A monad on Sets is a categorical construct. It consists of– an endofunctor T on Sets;
ηX– a unit natural transformation η : id ⇒ T , that is, a function X → T X for each
set X satisfying a suitable naturality condition; and– a multiplication natural transformation μ : T 2 ⇒ T , consisting of functionsμX
T 2 X → T X with X ranging over sets.
The unit and multiplication are required to satisfy the following compatibility conditions.
ηT X
T ηX
T μX
TX
TX
T 2X
T 3X
T 2X
μX
μT X
μX
id
id
TX
T 2 X μX T X
See [11, 96] for the details.
The monad structures play a crucial role in modeling “branching.” Intuitively,
the unit η embeds a non-branching behavior as a trivial branching (with only one
possibility to choose). The multiplication μ “ﬂattens” two successive branchings into
one branching, abstracting away internal branchings:
•

•

•

x
y
z

μ

•

−→

x
y
z

(2.8)

The following examples of monads will illustrate how this ﬂattening phenomenon isa crucial feature of trace semantics.
In this chapter we concentrate on the three monads mentioned in Section 2.1: L,
P and D.
– The lift monad L = 1 + ( )—where we denote 1 = {⊥} with ⊥ meaning deadlock —has a standard monad structure induced by a coproduct. For example,
the multiplication μL
X : 1 + 1 + X → 1 + X carries x ∈ X to itself and both ⊥’s
to ⊥.
– The powerset monad P has a unit given by singletons and a multiplication given
by unions. The monad P models non-deterministic branching: the “ﬂattening”
in (2.8) corresponds to the following application of the multiplication of P.



PPX

{x, y}, {z}

μP
X

PX
{x, y, z}2.2

Coalgebras in a Kleisli category29

The monad P’s action on arrows (as a functor) needs mention as well. It is
given by direct images: for f : X → Y , the function Pf : PX → PY carries a
subset u ⊆ X to the subset {f (x) | x ∈ u} ⊆ Y .
– The subdistribution monad D has a unit given by the Dirac distributions.
D
ηX

X



x

DX
x→1
x → 0(for x = x)

Its multiplication is given by multiplying the probabilities along the way. Thatis,"μDξ(d) · d(x) ,X (ξ) = λx.
d∈DX

which models “ﬂattening” of the following kind.
1/2 x
y
•
1/2
z
•
2/3
1
1/3 •

μ

•

−→

1/6

x

1/6

y ,

2/3

z

that is,⎡ ⎣

x → 1/2
y → 1/2[z → 1]



⎡

⎤
→

1/3 ⎦

→

2/3

μ

−→

⎤
x → 1/6⎣ y → 1/6 ⎦ .
z → 2/3

The monad D’s action on arrows (as a functor) is given as a suitable adaptationof “direct images.” Namely,
for f : X → Y , the function Df : DX → DYcarries d ∈ DX to [y → x∈f −1 (y) d(x)] ∈ DY .
Given any monad T , its Kleisli category K(T ) is deﬁned as follows. Its objects are
the objects of the base category, hence sets in the current setting. An arrow X → Y
in K(T ) is the same thing as an arrow X → T Y in the base category, here Sets.
X

Y in K(T )X

T Y in Sets

Identities and composition of arrows are deﬁned using the unit and the multiplicationof T . Moreover, there is a canonical adjunction

Sets

J
⊥
K

K(T )(2.9)

30

2 Trace semantics via coinduction
ηY ◦f

f

in which the “Kleisli inclusion” functor J carries X −→ Y in Sets to X −→ Y inK(T ); its right adjoint K carriesfX −→ YTf

in K(T ),fthat is, a function X −→ T Y

in SetsμY

to T X −→ T T Y −→ T Y in Sets. See [11, 96] for details.
The relevance of Kleisli categories in our coalgebraic expedition is that a Kleisli
category can be thought of as a category where the branching is implicit. For example,
an arrow X → Y in the Kleisli category K(P) is a function X → PY hence a “nondeterministic function.” When T = D, then by writing X → Y in the Kleisli category
we mean a function with probabilistic branching. Moreover, composition of arrows inK(T ) is given byfg

X −→ Y −→ Z

in K(T )

=

f

Tg

μZ

X −→ T Y −→ T 2 Z −→ T Z

in Sets;

that is, making one transition (by g) after another (by f ), and then ﬂattening (byμZ ). For example, this general deﬁnition instantiates as follows when T = D. Givenfg

X → Y → Z in K(D),(g ◦ f )(x)(z) =y∈Y f (x)(y) · g(y)(z).

2.2.1 Remark. Our use of the sub-distribution monad instead of the distributionmonad"
D=1 (X) = {d : X → [0, 1] |d(x) = 1}
x∈X

needs some justiﬁcation. Looking at the trace distribution (2.4), one sees that theprobabilities add up only to 2/3 and not to 1; this is because the inﬁnite trace (namelyaω → 1/3) are not present. Therefore in this example, although the state-based
system can be modeled as a coalgebra in the category K(D=1 ), its trace semantics
can only be expressed as an arrow in K(D).
When a system is modeled as a coalgebra in K(D), a state may have a (sub)distribution over possible transitions which adds up to less than 1. In that case themissing probability can be understood as the probability for deadlock.
Technically, we use the monad D instead of D=1 because we need the minimum element (a bottom) so that the Kleisli category becomes Cppo-enriched (Theorem 2.3.3).
A bottom is available for D as the zero distribution [x → 0], but not for D=1 .

2.2.2

Lifting functors by distributive laws

In this chapter a state-based system is presented as a coalgebra X → F X in K(T ),where F : K(T ) → K(T ) is a lifting of F : Sets → Sets. This lifting F → F isequivalent to a distributive law F T ⇒ T F . The rest of this section elaborates on thispoint.
Various kinds of state-based, branching systems are expressed as a function of thecform X → T F X with T a monad (for branching type) and F a functor (for transitiontype). The following examples are already hinted at in the previous section.

2.2

Coalgebras in a Kleisli category

31c– For T = P and F = 1 + Σ × , a function X → T F X is an LTS with explicit
termination. For example, consider the following systemXxc

P(1 + Σ × X)
{, (a1 , x1 ), (a2 , x2 )}where  is the element of 1.5 Then the state x can make three possible tranaasitions, namely: x →  (successful termination), x →1 x1 , and x →2 x2 , when
written in a conventional way.
– By replacing T = P by D, but keeping F the same, we obtain a probabilistic
system such as the one in the middle of (2.1). For example,Xc

D(1 + Σ × X)⎤
(a, y  ) → 1/3⎣ (a, z  ) → 1/3 ⎦.
 → 1/3⎡xc– For T = P and F = (Σ + )∗ , a function X → T F X is a CFG with Σ theterminal alphabet (but without ﬁniteness conditions e.g. on the state space).
See [43] for more details.
2.2.2 Remark. LTSs with explicit termination  can be roughly seen as nondeterministic automata (Remark 2.1.1). Coalgebraically, it is because of the following
isomorphism (which is natural in X).
∼=

2 × Pﬁn (Σ × X)

Pﬁn (1 + Σ × X)

(2.10)

It establishes an isomorphism between(2 × Pﬁn (Σ × ))-coalgebras

and

Pﬁn (1 + Σ × )-coalgebras ,hence between (ﬁnitely branching) non-deterministic automata and (ﬁnitely branching) LTSs with . These systems are almost LTSs with  (which we described before
this remark), except for the additional assumption of ﬁnite branching.
We shall not take special care of this condition of ﬁnite branching. Technicallyspeaking, the subsequent results work for T = P but not for T = Pﬁn ; it is because
we need a Cppo-enriched structure in K(T ). To illustrate the problem, look at theﬁrst system in (2.1). Although every branching in the system is ﬁnite, its trace map(which we will accommodate in K(T )) is no longer “ﬁnitely branching.”
5 Note that the singleton 1 = {} here in F

= 1+Σ×has a diﬀerent interpretation from
1 = {⊥} in T = L = 1 + . The intuition is as follows. On the one hand, when an execution hits
successful termination , it yields its history of observations as its trace. On the other hand, whenan execution hits deadlock ⊥ then it yields no trace no matter what is the history before hitting ⊥.
This distinction will be made formal in Example 2.4.3.

32

2 Trace semantics via coinductioncAll the systems listed above are modeled by a function X → T F X, hence an arrowc
X → F X in K(T ). Our question here is: is c a coalgebra in K(T )? In other words:
is the functor F on Sets also a functor on K(T )?
Hence, to develop a generic theory of traces in K(T ), we need to lift F to afunctor F on K(T ). A functor F is said to be a lifting of F if the following diagram
commutes. Here J is the left adjoint in (2.9).
F

K(T )J
Sets

F

K(T )
J
Sets(2.11)

The following fact is presented in [103]; see also [92, 93]. Its proof is straightforward.
2.2.3 Lemma. A lifting F of F is in bijective correspondence with a distributive
law λ : F T ⇒T F . A distributive law λ is a natural transformation which is compatible
with T ’s monad structure, in the following way.
FX

F ηX
ηF X

F T 2X
F μX
FTX

FTX
λX
TFX

λT X

TFTX

T λX

λX

T 2F XμF X
TFXA distributive law λ induces a lifting F as follows. On objects: F X = F X. Given
f : X → Y in K(T ), we need an arrow F f : F X → F Y in K(T ). Recall thatf is a function X → T Y in Sets; one deﬁnes F f to be the arrow in K(T ) whichcorresponds to the function
Ff

λ

Y
TFY
F X −→ F T Y −→in Sets .

Conversely, given a lifting F of F , one obtains a distributive law in the following way.
id

T X −→ T X in Sets
T X −→ X in K(T )F T X −→ F X

in K(T )F T X −→ T F X

in Sets

applying F to the arrow
F X = F X on objects, see (2.11)

A distributive law speciﬁes how a transition (of type F ) “distributes” over a
branching (of type T ). Let us look at an example. For T = P and F = 1 + Σ × (thecombination for LTSs with explicit termination), we have the following distributivelaw.
λX
P(1 + Σ × X)
1 + Σ × (PX)(a, S)

{}(a, x) | x ∈ S



2.2

Coalgebras in a Kleisli category

33

For example,
x
y
z


a, {x, y, z}•that is

a

·

a
x
·
a y ,
·
•
a
z
·


λ
−→
(a, x), (a, y), (a, z) ,λ−→where waving arrows  denote branchings.
Throughout this chapter we need the global assumption that a functor F has alifting F on K(T ), or equivalently, that there is a distributive law λ : F T ⇒ T F .
Now we present some suﬃcient conditions for existence of λ. In most examples oneof these conditions holds.
First, take T = P, in which case we have K(P) ∼= Rel, the category of sets andbinary relations. We can provide the following condition that uses relation liftings,
whose deﬁnition is found e.g. in [62].
2.2.4 Lemma ([133]). Let F : Sets → Sets be a functor that preserves weak pullbacks. Then there exists a distributive law λ : F P ⇒ PF given by
λX (u) =v ∈ F X | (v, u) ∈ RelF (∈X ),where u ∈ F PX and RelF (∈X ) ⊆ F X × F PX is the F -relation lifting of the mem
bership relation ∈X .
In fact, the functor F : Rel → Rel induced by this distributive law carries an arrow
R : X → Y in K(P)—which we can identify with a binary relation between X andY —to its F -relation lifting RelF (R). That is,
F R = RelF (R): F X −→ F Y(2.12)in K(P) ∼= Rel.
Now let us consider a monad T which is other than P. When a monad T iscommutative and a functor F is shapely, we can provide a canonical distributive law.
The class of such monads and functors is wide and all the examples in this chapter
are contained.
– A commutative monad [81] is intuitively a monad whose corresponding algebraic
theory has only commutative operators. We exploit the fact that a commutative
monad is equipped with an arrow called double strength
dstX,Y : T X × T Y −→ T (X × Y )(2.13)

for any sets X and Y ; the double strength must be compatible with the monadstructure of T in an obvious way.

34

2 Trace semantics via coinduction
Our three examples of monads are all commutative, with the following double
strengths.
#(u, v) if u ∈ X and v ∈ Y,
(u,
v)
=
dstL
X,Y
⊥
if u = ⊥ or v = ⊥,(2.14)dstP
X,Y (u, v) = u × v ,dstD
X,Y (u, v) = λ(x, y). u(x) · v(y) .
– The family of shapely functors 6 [69] on Sets is deﬁned inductively by the following BNF notation:$
F ::= id | Σ | F1 × F2 | i∈I Fi ,where Σ denotes the constant functor into an (arbitrary) set Σ. Notice thattaking an inﬁnite product is not allowed, nor an exponentiation to the power of
an inﬁnite set. This is in order to ensure that we ﬁnd an initial F -algebra as asuitable ω-colimit—see Proposition A.1.1.

2.2.5 Lemma. Let T : Sets → Sets be a commutative monad, and F : Sets → Setsa shapely functor. Then there is a distributive law λ : F T ⇒ T F .
Proof. The construction of a distributive law is done inductively on the constructionof shapely F .
– If F is the identity functor, then the λ is the identity natural transformation
T ⇒ T.
– If F is a constant functor, say X → Σ, then λ is the unit ηΣ : Σ → T Σ at
Σ ∈ Sets.
– If F = F1 ×F2 we use induction in the form of distributive laws λFi : Fi T ⇒ T Fi
for i ∈ {1, 2} to form the composite:
F1 T X × F2 T X– If F is a coproduct$

λF1 × λF2$i∈I Fi then we use laws λi∈I Fi (T X)

dst

T F1 X × T F2 X

[T (κi ) ◦ λFi ]i∈IFi

T (F1 X × F2 X) .

: Fi T ⇒ T Fi for i ∈ I in:$
T ( i∈I Fi X) .

It is straightforward to check that such λ is natural and compatible with the monadstructure.
Note that the results in the sequel rely on existence of a distributive law, but
not on e.g. commutative T and shapely F . The latter is a suﬃcient condition for
the former but not a necessary one, although this marginal generality is yet to be
exploited in our examples.
6 Shapely functors as they are called here are referred to as polynomial functors by some authors,although other authors allow inﬁnite powers or the powerset construction in their “polynomial”
functors.

2.2

2.2.3

Coalgebras in a Kleisli category

35

Order-enriched structures of Kleisli categories

The notion of branching naturally involves a partial order: one branching is bigger
than another if the former oﬀers “more possibilities” than the latter. Formally, thisorder appears as the Cppo-enriched structure of a Kleisli category. It plays animportant role in the initial algebra-ﬁnal coalgebra coincidence in Section 2.3.1.
A Cppo-enriched category C is a category where:– Each homset C(X, Y ) carries a partial order  as in
g
Y



X

f
which makes C(X, Y ) an ω-cpo with a bottom. This means:• for an increasing ω-chain of arrows from X to Y ,%f0  f1  . . .

:X −→ Y ,there exists its join n<ω fn : X → Y ;• for any X and Y there exists a bottom arrow ⊥X,Y : X → Y which is theminimum in C(X, Y ).
– Moreover, composition of arrows is continuous as a function C(X, Y )×C(Y, Z) →C(X, Z). This means preservation of the following joins:7


%
%
%
%
=
g◦
and
n<ω fnn<ω (g ◦ fn )n<ω fn ◦ h =n<ω (fn ◦ h) .
Note that composition need not preserve bottoms (i.e. it is not necessarily
strict).
This is in fact an instance of a more general notion of V-enriched categories where V isthe category Cppo of pointed (i.e. with ⊥) cpo’s and continuous (but not necessarily
strict) functions. See [19, 73, 89] for more details on enriched category theory, and [2]on cpo’s and domain theory.
2.2.6 Lemma. For our three examples L, P and D of a monad T , the Kleisli category
K(T ) is Cppo-enriched. Moreover, composition of arrows is left-strict: ⊥ ◦ f = ⊥.
The left-strictness of composition will be necessary later.
Proof. Notice ﬁrst that a set T Y for T ∈ {L, P, D} carries a cpo structure with ⊥.
The set LY = {⊥} + Y carries the ﬂat order with a bottom:
y

y

y 

···

⊥
7 This component-wise preservation of joins is equivalent to the continuity of the composition
function. See [2, Lemma 3.2.6].

36

2 Trace semantics via coinduction

embodying the idea that ⊥ denotes non-termination or deadlock —in contrast to 
for successful termination. The set PY carries an inclusion order; in DY we havethe pointwise order—d  e if d(y) ≤ e(y) for each y ∈ Y . The bottom element in
DY is the zero distribution [y → 0]: this belongs to the set DY because D is the
sub-distribution monad.
The cpo structure of a homset K(T )(X, Y ) comes from that of T Y in a pointwisemanner:XgY

if and only if∀x ∈ X. f (x) T Y g(x) .

f
It is laborious but straightforward to show that composition in K(T ) is continuousand left-strict.

We are concerned with coalgebras X → F X in the category K(T ), which we
assume is Cppo-enriched. Hence it comes natural to require that the functor Fshould be somehow compatible with the Cppo-enriched structure of K(T ). The
obvious choice is to require that F is a Cppo-enriched functor (see e.g. [19]), i.e. F islocally continuous in this setting. It means that for an increasing ω-chain fn : X → Y ,we have&&F(fn ) =(F fn ) .
n<ωn<ωThis is indeed the assumption universally chosen in axiomatic domain theory; we will
come back to this point later in Section 2.3.3. However, for our later purpose, only
local monotonicity is suﬃcient: f  g implies F f  F g.
For a monad T ∈ {L, P, D} and a shapely functor F (recall Lemma 2.2.5), thelifted F is indeed locally continuous. We emphasize again that this does not imply
our results in Section 2.3 hold exclusively for shapely functors: being shapely is a
suﬃcient condition for the assumption of those later results.
2.2.7 Lemma. Let F be a shapely functor and T ∈ {L, P, D}. The lifting F :K(T ) → K(T ) induced by Lemma 2.2.5 is locally continuous.
Proof. By induction on the construction of shapely functors.
– F = id, the identity functor. Then F = id which satisﬁes the condition.
– F = Σ, a constant functor. Then F maps every arrow to the identity map on
Σ in K(T ). This is obviously locally continuous.
– F = F1 × F2 . First notice that, for f : X → Y in K(T ), we obtain F f as thefollowing composite in Sets.
F1 X × F2 X

F1 f × F2 f
Ff

T F1 Y × T F2 Y
dstF1 Y,F2 Y
T (F1 Y × F2 Y )2.3

Final coalgebra in a Kleisli category

37

Because the order in K(T )(F X, F Y ) is pointwise, it suﬃces to show the following: dst : T X × T Y → T (X × Y ) is a continuous map between cpo’s. It iseasy to check that this is indeed the case. See (2.14).
$– F = j∈J F$j . For f : X → Y in K(T ), we obtain the map F f as the composite[T κj ]j∈J ◦ j∈J K(Fj )(f ) in Sets. Since the order$ on the homset is pointwise,
it suﬃces to show that each T κj : T Fj Y → T ( j∈J Fj Y ) is continuous. Thisis easy.


2.3

Final coalgebra in a Kleisli category

In this section we shall prove our main technical result of this chapter: an initial F algebra in Sets yields a ﬁnal F -coalgebra in K(T ). It happens in the following two
steps: ﬁrst, an initial algebra in Sets is lifted to an initial algebra in K(T ); second wehave the initial algebra-ﬁnal coalgebra coincidence in K(T ). For the latter we use theclassical result [127] of limit-colimit coincidence. This is where the Cppo-enriched
structure of K(T ) plays a role.
In the proof we use two standard constructions: initial/ﬁnal sequences [5] andlimit-colimit coincidence [127]. The reader who is not familiar with these constructions
is invited to look at Appendices A.1 and A.2 where we brieﬂy recall them.
2.3.1 Remark. The proof of our main theorem (Theorem 2.3.3) can be simpliﬁed if
we suitably strengthen the assumptions. First, if we assume local continuity of thelifted functor F (instead of local monotonicity that is assumed in our main theorem),then the initial algebra-ﬁnal coalgebra coincidence follows from a standard result inaxiomatic domain theory; see Section 2.3.3. Furthermore, for the special case T = P
in which case K(P) ∼= Rel, the initial algebra-ﬁnal coalgebra coincidence is almost
obvious due to the duality Rel ∼= Relop ; see Section 2.3.2.

2.3.1

An initial algebra in Sets yields a final coalgebra in K(T )First, it is standard that an initial algebra in Sets is lifted to an initial algebrain K(T ). Such a phenomenon is studied for instance in [33, 106] in the context
of combining datatypes (modeled by an initial algebra) and eﬀectful computations(modeled by a Kleisli category). For this result we do not need an order structure.
2.3.2 Proposition. Let T be a monad and F be a endofunctor, both on a category
C. Assume that we have a distributive law F T ⇒ T F —or equivalently, we have a∼=
A in C, thenlifting F on K(T ). If F has an initial algebra α : F A →Jα = ηA ◦ α :F A −→ Ain K(T )is an initial F -algebra. Here J is the canonical Kleisli left adjoint as in (2.9).
We will use an instance of this result for C = Sets.

38

2 Trace semantics via coinduction

Proof. It follows from [54, Theorem 2.14] that a distributive law lifts the canonicalKleisli adjunction to an adjunction between the categories AlgF and AlgF of algebras.
J
⊥

AlgF
F

J
⊥
K

C

AlgF
K(T ) F

The left adjoint J  preserves an initial object (see e.g. [96]).

Second, we use the initial algebra-ﬁnal coalgebra coincidence in K(T )—whichholds in a suitable order-enriched setting—to identify a ﬁnal coalgebra in K(T ).
This is our main results of the chapter.
2.3.3 Theorem (Main theorem of Chapter 2). Assume the following conditions.
1. A monad T on Sets is such that its Kleisli category K(T ) is Cppo-enrichedand composition in K(T ) is left-strict.
2. For an endofunctor F on Sets, we have a distributive law λ : F T ⇒ T F .
Equivalently, F has a lifting F on K(T ). Moreover, the lifting F is locallymonotone.
3. The functor F preserves ω-colimits in Sets, hence has an initial algebra via theinitial sequence (see Proposition A.1.1).
Such a triple (F, T, λ) shall be called a trace situation.
∼=
A yields a ﬁnal F -coalgebra in K(T ) by
Then the initial F -algebra α : F A →(Jα)−1 = J(α−1 ) = ηF A ◦ α−1 :A −→ F A

in K(T ) .

We ﬁrst present the main line of the proof. Some details are provided in the form ofsubsequent lemmas. Note that the assumptions are satisﬁed by T ∈ {L, P, D} andshapely F ; see Lemmas 2.2.6 and 2.2.5.
Proof. By the assumption (3) we obtain an initial algebra via the initial sequence in
Sets.
In Sets···αnF n−1 ¡

F n0

F n+1 0F αn−1

αn+1
···
F αn

A

(colimit)

α ∼
= α−1
FA

(2.15)(colimit)

Here 0 = ∅ ∈ Sets is initial and ¡ : 0 → X is the unique arrow from 0 to an arbitrary
X. We apply the functor J : Sets → K(T ) to the whole diagram. Since a left adjoint

2.3

Final coalgebra in a Kleisli category

39

J preserves colimits, the two cocones in the following diagram are both colimits again.
In K(T )···JαnJF n−1 ¡

F n0

Jαn+1
···

F n+1 0JF αn−1

JF αnA(colimit)Jα ∼= Jα−1FA(2.16)(colimit)

The ω-chain in this diagram is in fact the initial sequence for the functor F (Lemma
2.3.4) because, for example, a left adjoint J preserves initial objects. Moreover the
lower cone is the image of the upper cone under F because JF = F J; see the diagram (2.11). Hence the diagram (2.16) is equal to the following one. Recall thatF X = F X on objects.
In K(T )
F

···

A

Jαn
n−1

¡

n

F 0

F

(colimit)

Jαn+1
n+1

···

0

Jα ∼
= Jα−1F Jαn

F Jαn−1FA(2.17)(colimit)∼=
A is an initial F -algebra. This can beThus Proposition A.1.1 yields that Jα : F A →seen as a more concrete proof of Proposition 2.3.2.
Now we show the initial algebra-ﬁnal coalgebra coincidence in K(T ). This is doneby reversing all the arrows in (2.17) and transforming the diagram into the one of the
ﬁnal sequence and its limits.
n
We notice (Lemma 2.3.6) that each arrow F ¡ in the initial sequence is an embedding (in the sense of embedding-projection pairs; see Deﬁnition A.2.1). Hencethe limit-colimit coincidence Theorem A.2.5 says that every arrow in the diagram isan embedding. Note that Jα and Jα−1 , inverse to each other, form an embeddingprojection pair.
By taking the corresponding projections—they are uniquely determined (Lemma A.2.2)
and are denoted by ( )P —we obtain the next diagram. The limit-colimit coincidence
Theorem A.2.5 says that the two resulting cones are both limits. It is also obviousthat the whole diagram commutes.

In K(T )···(F(Jαn )P
n−1

¡ )P

n

F 0

F

n+1

(Jαn+1 )P
0

···

A

(Jα)P ∼= (Jα−1 )P(F Jαn )PP(F Jαn−1 )(limit)FA(limit)(2.18)

40

2 Trace semantics via coinduction

The ω op -chain here is indeed a ﬁnal sequence: Lemma 2.3.5 shows—using the assumption (1) on left-strictness—that 0 is also ﬁnal in K(T ), and according to Lemma 2.3.6nn
we have (F ¡ )P = F ! where ! : X → 0 is the unique arrow to the ﬁnal object 0 inPK(T ). As to the lower cone we have F Jαn = F (Jαn )P by Lemma 2.3.7.
Hence the diagram (2.18) is equal to the following one, showing the ﬁnal sequencefor F , its limit (the upper one) and that limit mapped by F (the lower one) which isagain a limit.
In K(T )···(Jαn )P
F

n−1

!

n

F 0

F

n+1

A

(Jαn+1 )P0···(limit)= JαJα−1 ∼F (Jαn )PP

FA

F (Jαn−1 )(2.19)(limit)By Proposition A.1.2 we conclude that Jα−1 is a ﬁnal F -coalgebra.

In the remainder of this section the lemmas used in the above proof are presented.
We work with a trace situation (F, T, λ), i.e. those which satisfy the assumptions asin Theorem 2.3.3.
2.3.4 Lemma. The ω-chain in the diagram (2.16) is indeed the initial sequence for
F . That is, we have for each n < ω,n
JF n ¡ Sets = F ¡ K(T ) : JF n 0 −→ JF n+1 0 in K(T ),where ¡ Sets : 0 → F 0 in Sets and ¡ K(T ) : 0 → F 0 in K(T ) denote the unique maps.
Proof. By induction on n. For n = 0 the two maps are equal due to initiality of
J0 = 0 in K(T ). For the step case we use the commutativity JF = F J of (2.11). 
2.3.5 Lemma. The empty set 0 is both an initial and a ﬁnal object in K(T ).
In particular, this implies that the object T 0 is ﬁnal in Sets, hence T 0 ∼= 1.
Proof. The functor J : Sets → K(T ) preserves initial objects since it is a left adjoint.
Therefore 0 = J0 is initial in K(T ). Finality follows essentially from the left-strictness
assumption: for each set X there exists at least one arrow X → 0 in K(T ), forexample ⊥X,0 . To show the uniqueness of such an arrow, take an arbitrary arrowf : X → 0 in K(T ). Recalling that the bottom map ⊥0,0 : 0 → 0 is also the identity
arrow in K(T ) because of initiality, we obtain(∗)

f = id ◦ f = ⊥0,0 ◦ f = ⊥X,0 ,where the compositions are taken in K(T ) and the equality marked by (∗) holds byleft-strictness of composition.
2.3

Final coalgebra in a Kleisli category41n2.3.6 Lemma. Each arrow F ¡ in the initial sequence for F , as in the diagram(2.17), is an embedding. Its corresponding projection is given byF n P
n
F ¡
=F !

in

!
F n+1 0 .

F 0
F

n

n

n

n

¡

n

Proof. We show that (F ¡ , F ! ) is an embedding-projection pair for all n < ω. Wennhave F ! ◦ F ¡ = id because ! ◦ ¡ = id. For the other half we havennnF ¡ ◦ F ! = F (¡ ◦ !)n

= F (⊥0,F 0 ◦ ! )initiality of 0 in K(T )n= F (⊥F 0,F 0 )composition is left-strictn F (id) = id

F is locally monotone.



P



= F (Jαn )P . Hence the lower cone in the
2.3.7 Lemma. We have F Jαndiagram (2.18) is the image of the upper cone under F .

Proof. It is easy to check that F Jαn , F (Jαn )Pindeed form an embeddingprojection pair. Therein we use the monotonicity of F ’s action on arrows.


2.3.2

Simpler proof in K(P) ∼= Rel

When T = P we have the self-duality
Op

:

∼
=

K(P)op −→ K(P) .

This is because of the following bijective correspondence between functions
X
Y

f
f∨

PY in Sets
PX in Sets

given by f ∨ (y) = {x ∈ X | y ∈ f (x)}. Recalling K(P) ∼= Rel, this mapping f → f ∨carries a relation to its opposite relation.
Due to this “global” duality K(P) ∼= K(P)op , the proof of Theorem 2.3.3 isdrastically simpliﬁed for T = P. It essentially relies on the lifted self duality AlgF ∼=AlgF op , where the latter is isomorphic to (CoalgF )op . We do not need here an order
structure of K(P) nor local monotonicity of F .
2.3.8 Theorem. Let F : Sets → Sets be a functor which preserves weak pullbacks,and F : K(P) → K(P) be its lifting induced by relation lifting (Lemma 2.2.4). Then
an initial F -algebra in Sets yields a ﬁnal F -coalgebra in K(P).

42

2 Trace semantics via coinduction

Proof. We have the following situation because of the self-duality of K(P).
J
⊥
K

Sets
F

Op op
∼
=

K(P)
F

K(P)opF

op∼=
The adjunction J  K and the isomorphism Op : K(P)op →K(P) lift to thosebetween the categories of algebras.

AlgF
Sets
F

J
⊥
J
⊥
K

AlgF

(Op  )op∼=

AlgF op

K(P)

Op op
∼
=

K(P)opF

F∼=(CoalgF )op

op∼=
Indeed, J  K lifts due to Proposition 2.3.2; the lifted isomorphism Op  : AlgF →op
AlgF is because of the following commutativity:

K(P)opOp

opF
K(P)op

Op

K(P)
F
K(P)

(2.20)

which is because: F R = RelF (R) (see (2.12)); and taking relation liftings is compatible with opposite relations (i.e. RelF (Rop ) = (RelF R)op , see [58]). Moreover the
category AlgF op is obviously isomorphic to (CoalgF )op .
Therefore an initial object in AlgF is carried to an initial object in (CoalgF )op ,
hence to a ﬁnal object in CoalgF .
op∼For monads such as T = D a “global” self-duality K(T ) = K(T ) is not available.
Instead, in the proof of Theorem 2.3.3, we exploit the “partial” duality which holds
between the colimit/limit of the initial/ﬁnal sequence.

2.3.3

Related work: axiomatic domain theory

The initial algebra-ﬁnal coalgebra coincidence is heavily exploited in the ﬁeld of axiomatic domain theory, e.g. in [31, 34, 35, 125]. There, categories which have an initial
algebra and a ﬁnal coalgebra coinciding with each other, for each endofunctor, arecalled algebraically compact categories. They draw special attention as suitable “categories of domains” for denotational semantics of datatype construction. The relevancecomes as follows.
Let C be a “category of domains.” One thinks of an object of the category C as a
type. A “recursive datatype constructor” is presented as a bifunctor G : Cop ×C → C.

2.3

Final coalgebra in a Kleisli category

43

Note the presence of both covariance and contravariance. One expects that such acategory C has a canonical ﬁxed point Fix G such that∼=Fix G ,G(Fix G, Fix G) →which represents the recursive type determined by the datatype constructor G. Freyd [34]showed that if C is algebraically compact, then one can construct such a ﬁxed point
as a suitable initial algebra; moreover this ﬁxed point is shown by Fiore [31] to be acanonical one in a suitable sense. The rough idea here is that the covariant part of G
is taken care of by an initial algebra; the contravariant part is by a ﬁnal coalgebra;
the initial algebra-ﬁnal coalgebra coincidence yields a ﬁxed point of overall G.
Typical examples of algebraically compact categories are enriched over Cppo or
one of its variants. This conforms the traditional use of the word “domain” for certain
cpo’s (e.g. in [2]).
Although in this chapter we utilize the initial algebra-ﬁnal coalgebra coincidence
result in K(T ), we are not so much interested in algebraic compactness of K(T ).
This is because our motivation is diﬀerent from that of axiomatic domain theory. In
studying trace semantics for coalgebras, we need not deal with every endofunctor onK(T ), but only such an endofunctor F which is a lifting of F : Sets → Sets.
Local continuity vs. local monotonicity In axiomatic domain theory, Cppoenriched categories are said to be algebraically compact because, “in a 2-category
setting” [35], every endofunctor has an initial algebra and a ﬁnal coalgebra. Concretely
this means: “every locally continuous functor.”
In this spirit, we could have made a stronger assumption of F ’s local continuity in Theorem 2.3.3 instead of local monotonicity. If we do so, in fact, the proofof Theorem 2.3.3 becomes much simpler: the following proposition (Lemma in [35,p.98]) immediately yields the initial algebra-ﬁnal coalgebra coincidence for a locallycontinuous F .
2.3.9 Proposition ([35]). Let D be a Cppo-enriched category whose composition isleft-strict, and G : D → D be a locally continuous endofunctor. An initial algebra∼∼==β : GB →B, if it exists, yields a ﬁnal coalgebra β −1 : B →GB.
Proof. Given a coalgebra d : Y → GY , the function
Φ : D(Y, B) −→ D(Y, B) ,f −→ β ◦ Gf ◦ d

is continuous due to the local% continuity of G. Hence by the Knaster-Tarski theorem
it has the least ﬁxed point n<ω Φn (⊥); this proves existence of a morphism from dto β −1 .
GBGY∼= β −1d
Y
B
Now we shall show its uniqueness. Assume that g : Y → B is a morphismof coalgebras as above, that is, Φ(g) = g. Similarly to Φ, we deﬁne a function

44

2 Trace semantics via coinduction

Ψ : D(B, B) → D(B, B) as the one which carries h : B → B to β ◦ Gh ◦ β −1 . We
have
% n
% n
g
⊥
composition is left-strict, so ⊥ ◦ g = ⊥n Φ (⊥) =n Φ (Y → B → B)

%  n
n
= n Ψ (⊥) ◦ Φ (g)Φn (⊥ ◦ g) = Ψn (⊥) ◦ Φn (g), by induction
% n % n =Ψ (⊥) ◦
composition is continuousn Φ (g)% n n% n= n Φ (g)n Ψ (⊥) = id, (∗)=g

Φ(g) = g by assumption.

%
Here (∗) holds because n Ψn (⊥), being a ﬁxed point for Ψ, is the unique morphismof algebras from β to β. This shows that the morphism g must be the least ﬁxed
point of Φ, which is unique.

For our main Theorem 2.3.3 of this chapter we can do with only local monotonicityof the lifted functor F , by taking a closer look at the initial/ﬁnal sequences. Howeverat this stage it is not clear how much we gain from this generality: up to now we havenot found an example where the functor F is only locally monotone (and not locallycontinuous).

2.3.4

Related work: functional programming

Datatypes and eﬀects In a diﬀerent context of functional programming, thework [106] also studies initial algebras and ﬁnal coalgebras in a Kleisli category. The
motivation there is to combine datatypes and eﬀects. More speciﬁcally, an initial algebra and a ﬁnal coalgebra support the fold and the unfold operators, respectively,
used in recursive programs over datatypes. A computational eﬀect is presented as amonad, and its Kleisli category is the category of eﬀectful computations.
The diﬀerence between [106] and the current work is as follows. In [106], the original, base category of pure functions is already assumed to be algebraically compact;
the paper studies the conditions for the base category’s algebraic compactness to be
carried over to a Kleisli category. In contrast, in the current work, it is a monad—with a suitable order structure, embodying the essence of “branching”—which yields
the initial algebra-ﬁnal coalgebra coincidence in a Kleisli category; the coincidence is
not present in the original category Sets.
Relational reﬁnement calculus In a yet another context, initial algebras in the
category Rel of sets and relations are investigated in [16, 101]. The category Rel isisomorphic to the Kleisli category K(P), an instance of our general Kleisli framework.
The aim in [16, 101] is to develop a reﬁnement calculus which involves algebraic
datatypes: starting from a speciﬁcation of a desired function, such a calculus allows
one to derive an implementation of—i.e. an algorithm which realizes—the desired
function, by repeatedly applying derivation rules of the calculus (such as “fusion
laws”). The desired function is an arrow in Sets; however one can make intermediate
derivations in the extended domain of Rel and come back at the very last moment

2.4

Finite trace semantics via coinduction

45

to Sets. Working in Rel gives one much more freedom. For example one can takethe inverse of every arrow in Rel.
Since their main concern is in initial algebras in Rel, the lifting result (our Proposition 2.3.2) is fundamental in their investigation. Moreover, as we have seen in
Section 2.3.2, the initial algebra-ﬁnal coalgebra coincidence is much easier to see inthe special case of Rel ∼= K(P). In fact identiﬁcation of ﬁnal coalgebras in Rel isalmost implicit in [16]: one important technical ingredient in Section 2.3.2 is the compatibility diagram (2.20) which is present in [16, pp.112] (in a more general setting ofallegories). Nevertheless the crucial initial algebra-ﬁnal coalgebra coincidence in Rel
is not explicitly presented in [16].
The main result of [101] (Theorem 5) does explicitly mention ﬁnal coalgebras, but
in a category diﬀerent from Rel. The result is about ﬁnal coalgebras in the category
Tran of sets and monotone predicate transformers between them. Up to now we are
yet to ﬁnd a direct connection between our result and the one in [101].

2.4

Finite trace semantics via coinduction

In this section we shall further illustrate the observation that the principle of coinduction, when employed in K(T ), captures trace semantics of state-based systems.
As we have shown in the previous section, an initial algebra in Sets constitutes thesemantic domain, i.e. is a ﬁnal coalgebra in K(T ). Viewing an initial algebra as theset of well-founded terms (such as ﬁnite words or ﬁnite-depth parse trees), this factmeans that the “trace semantics” induced by coinduction is inevitably ﬁnite, in thesense that it captures only ﬁnite-depth behaviors. Here we will elaborate on thisﬁniteness issue as well.

2.4.1

Trace semantics by coinduction

As we have seen in Section 2.2.2 various types of state-based systems allow theirpresentation as coalgebras X → F X in a Kleisli category K(T ). For example,– LTSs with explicit termination, with T = P and F = 1 + Σ × ;– probabilistic LTSs (also called generative probabilistic transition systems in [40,128]) with explicit termination, with T = D and F = 1 + Σ × ;– context-free grammars with T = P and F = (Σ + )∗ .
The main observation underlying this work is the following. If we instantiate theparameters
T for branching type

andF for transition type46

2 Trace semantics via coinductionin the coinduction diagram
F (tr(c))
FX
c
X

FA
∼
= Jα−1A

tr(c)in K(T )(2.21)

with one of the above choices, then the commutativity of the diagram is equivalent
to the corresponding (conventional) deﬁnition of trace semantics in Section 2.1.1.
Therefore we claim that the diagram (2.21) is the mathematical principle underlying
various “trace semantics,” no matter if it is “trace set” (non-deterministic) or “trace
distribution” (probabilistic).
2.4.1 Deﬁnition (Trace semantics for coalgebras). Let (F, T, λ) be a trace situation∼=
A is an initial F -algebra in Sets. Given a coalgebra(Theorem 2.3.3), and α : F A →c : X → T F X in Sets, we can assign a function
tr(c) : X −→ T A

in Sets

which is, as an arrow X → A in K(T ), the unique one making the diagram (2.21)
commute. We shall call this function tr(c) the (ﬁnite) trace semantics for the coalgebrac.

2.4.2 Example. As further illustration we give details for the choice of parameters
T = P and F = 1 + Σ × . This is the suitable choice of parameters to deal with theﬁrst system in (2.1).
Now the coinduction diagram looks as follows. Recall that an initial F -algebra is
carried by the set Σ∗ of ﬁnite words.
1+Σ×X
c
X

1 + Σ × tr(c)tr(c)

1 + Σ × Σ∗∼
= J([nil, cons])−1Σ∗in K(P)(2.22)

It assigns, to a system c, a function tr(c) : X → P(Σ∗ ) which carries a state x ∈ X
to the set of ﬁnite words on Σ which can possibly arise as an “execution trace” of cstarting from x. The commutativity states equality of two arrows X ⇒ 1 + Σ × Σ∗in K(P), that is, functions X ⇒ P(1 + Σ × Σ∗ ). Let us denote these functions by
u = (1+Σ×tr(c)) ◦ c (up, then right),

v = J([nil, cons])−1 ◦ tr(c)(right, then up).

For each x ∈ X, the following conditions—derived straightforwardly by deﬁnition ofcomposition of K(P), lifting of the functor 1 + Σ × , etc.—specify u and v’s value
at x, as a subset of 1 + Σ × Σ∗ .
 ∈ u(x)(a, σ) ∈ u(x) ∈ v(x)(a, σ) ∈ v(x)

⇐⇒
⇐⇒
⇐⇒
⇐⇒

 ∈ c(x) ∃x ∈ X. (a, x ) ∈ c(x) ∧ σ ∈ tr(c)(x ) ∈ tr(c)(x)a · σ ∈ tr(c)(x)2.4

Finite trace semantics via coinduction

47

Commutativity of (2.22) amounts to u = v; this leads to the condition (2.3).
From a diﬀerent point of view we can also say as follows: ﬁnality of the coalgebra∼=Σ∗ →1 + Σ × Σ∗ in (2.22) ensures that the conventional recursive deﬁnition (2.3)
uniquely determines a function tr(c) : X → P(Σ∗ ). That is, tr(c) is well-deﬁned.
An easy consequence of the recursive deﬁnition (2.3) is
a1 . . . an ∈ tr(c)(x)⇐⇒∃x1 , . . . , xn ∈ X.

aan
x →1 · · · →xn →  .

Therefore every trace a1 . . . an ∈ tr(c)(x) has termination  implicit at its tail. In
particular, the set tr(c)(x) is not necessarily preﬁx-closed: a1 . . . an an+1 . . . an+m ∈tr(c)(x) does not imply a1 . . . an ∈ tr(c)(x).
2.4.3 Example. Let us take T = L (the lift monad) and F = 1 + Σ ×ccase a coalgebra X → L(1 + Σ × X) in Sets is a system which can. In this– get into a deadlock (c(x) = ⊥ with L = {⊥} + ),– successfully terminate (c(x) =  with F = {} + Σ × ), or– output a letter from Σ and move to the next state (c(x) = (a, x )).
By examining trace semantics for such systems, we shall formally put the diﬀerence
between the computational meanings of the two elements, ⊥ and .
The coinduction diagram (2.21) instantiates to the same diagram as (2.22), but
now in the category K(L). Easy calculation shows that its commutativity amounts
to the following condition. The function
X

tr(c)

L(Σ∗ ) = {⊥} + Σ∗

in Setssatisﬁes, for each x ∈ X,
tr(c)(x) = tr(c)(x) = a · σtr(c)(x) = ⊥⇐⇒ c(x) =  ,⇐⇒ ∃x ∈ X. c(x) = (a, x ) ∧tr(c)(x ) = σ ,⇐⇒ c(x) = ⊥ or ∃x ∈ X. c(x) = (a, x ) ∧ tr(c)(x ) = ⊥ .
(2.23)

Here σ ∈ Σ∗ is a word in Σ.
For the systems under consideration, we can think of the following three diﬀerent
kinds of possible executions.
aanxn → . By the– An execution eventually hitting , that is, x →1 · · · →condition (2.23) it yields a word tr(c)(x) = a1 . . . an as its trace.

aan
xn → ⊥. By the third– An execution eventually hitting ⊥, that is, x →1 · · · →line of (2.23) we see that tr(c)(xn ) = ⊥; moreovertr(c)(xn−1 ) = tr(c)(xn−2 ) = · · · = tr(c)(x) = ⊥ .
It properly reﬂects our intuition that a state x that eventually goes into deadlock
does not yield a ﬁnite (i.e. “terminating”) trace.

48

2 Trace semantics via coinductionaa– An execution not hitting  nor ⊥, that is, x →1 x1 →2 · · · . In this case, theonly possible solution of the “recursive equation” (2.23) is tr(c)(x) = tr(c)(x1 ) =· · · = ⊥. The intuition here is: a state leading to livelock does not yield a ﬁnite
trace.

2.4.2

Infinite traces

The trace semantics obtained via coinduction (Deﬁnition 2.4.1) assigns, to each statex ∈ X, “a set of” (if T = P) or “a distribution over” (if T = D) elements of the initial
algebra A. Elements of A are thought of as possible linear behaviors of the systemdetermined by the transition type (i.e. the functor F ).
Now the intuition is that an initial F -algebra A consists of the well-founded (orﬁnite-depth) terms and a ﬁnal F -coalgebra Z consists of the possibly non-well-founded(or inﬁnite-depth) terms. For example,– for F = 1+Σ× , A = Σ∗ consists of all the ﬁnite words, and Z = Σ∞ = Σ∗ +Σω
is augmented with streams, i.e. inﬁnite words;– for F = (Σ + )∗ , A is the set of ﬁnite-depth skeletal parse trees (see [43]), andZ additionally contains inﬁnite-depth ones;– for F = Σ ×
Z = Σω .

which models LTSs without explicit termination, A = 0 and

Therefore our trace semantics X → T A takes account of only ﬁnite-depth, wellfounded linear-time behaviors but not inﬁnite-depth ones. This is why the trace set(2.2) does not contain abω ; it is also why we have been talking about LTSs with
explicit termination—otherwise the ﬁnite trace semantics is always empty.
Designing a coalgebraic framework to capture possibly inﬁnite trace semantics isthe main aim of [62]. The work is done exclusively in a non-deterministic setting andthe main result reads as follows.
2.4.4 Theorem (Possibly inﬁnite trace semantics for coalgebras, [62]). Let F be a∼=
F Z be a ﬁnal coalgebra in Sets. The coalgebra
shapely functor on Sets, and ζ : Z →Jζ : Z −→ F Z

in K(P)is weakly ﬁnal: that is, given a coalgebra c : X → F X, there is a morphism from c toJζ but the morphism is not necessarily unique.
F (tr∞ (c))
FX
cX

tr∞ (c)

FZ
∼
= Jζ
Z

in K(P)(2.24)

Still there is a canonical choice tr∞ (c) among such morphisms, namely the one
which is maximal with respect to the inclusion order. We shall call the function
tr∞ (c) : X → PZ the possibly-infinite trace semantics for c.

2.4

Finite trace semantics via coinduction

49

Note here that, when we take F = 1 + Σ × and T = P (the choice for LTSs withtermination), commutativity of (2.24) boils down to exactly the same conditions as(2.3):
 ∈ tr∞ (c)(x)a · σ ∈ tr∞ (c)(x)⇐⇒ x → ,a⇐⇒ ∃y. ( x → y ∧ σ ∈ tr∞ (c)(y) ).

∼(2.25)∼==
1 + Σ × Σ∞ (corresponding to Z →F Z in (2.24)) means the
Weak ﬁnality of Σ∞ →following. The recursive deﬁnition (2.25)—although it looks valid at the ﬁrst sight—
does not uniquely determine the inﬁnite trace map tr∞ (c) : X → P(Σ∞ ). Instead,the map tr∞ (c) we want is the maximal one among those which satisfy (2.25).
As an example take the ﬁrst system in (2.1). We expect its possibly-inﬁnite trace
map X → P(Σ∞ ) to be such that x → ab∗ +abω and y → b∗ +bω . Indeed this satisﬁes(2.25) and is moreover the maximal. However, the function x → ab∗ and y → b∗ —this is actually the ﬁnite trace X → P(Σ∗ ) embedded along Σ∗ → Σ∞ —also satisﬁes(2.25). In fact, [43, Section 5] shows a general fact that such an embedding of the
ﬁnite trace map is the minimal one among those morphisms which make the diagram(2.24) commute.
The coalgebraic characterization (Theorem 2.4.4) of possibly-inﬁnite trace semantics is not yet fully developed. In particular the current proof of Theorem 2.4.4(in [62]) is fairly concrete and a categorical principle behind it is less clear than the
one behind ﬁnite traces. Consequently the result’s applicability is limited: we do notknow whether the result holds in a probabilistic setting; or whether it holds for any
weak-pullback-preserving functor F .

2.4.3

Accepted languages via determinization

In Example 2.4.2 we illustrated that our coalgebraic framework successfully captures
trace semantics for (non-deterministic) labeled transition system with explicit termination, that is, accepted languages of non-deterministic automata (see Remark 2.2.2).
There is another standard way to capture accepted language by coinduction, namely
via determinization of non-deterministic automata. It appears for example in [116];
here we brieﬂy describe the construction.
The construction is in fact the standard determinization procedure—which transforms a non-deterministic automaton (NDA) with a state space X into a deterministic
one (DA) with a state space PX—described coalgebraically. Deterministic automata
are modeled as coalgebras for the functor G = 2 × ( )Σ to which, as easy calculationshows, coinduction assigns accepted languages. Therefore what we do is to transform
an NDA to a DA, and apply coinduction to the latter. In its course we will utilize
the isomorphism (2.10) without the ﬁniteness assumption. That is,
2 × P(Σ × X)∼=

P(1 + Σ × X).

(2.26)In the sequel we put F = 1 + Σ × and G = 2 × ( )Σ . Hence (2.26) establishes an∼=isomorphism GP =⇒ PF . It is easy to see its naturality.

50

2 Trace semantics via coinductioncGiven a NDA X → PF X, we transform it to a DA (i.e. a G-coalgebra) in thefollowing way.
μP

Pc

∼
=

FX
PX −→ P 2 F X −→PF X −→ GPX

We denote this composite by det(c). Now it is standard that a ﬁnal G-coalgebra is
carried by the set P(Σ∗ ) of languages over Σ, with its structure given as follows.
Σ
2 × P(Σ∗ ), δ

with(L) = T ⇐⇒  ∈ L ,δ(L)(a) = {σ | a · σ ∈ L} .

P(Σ∗ )The operation δ is called the Brzozowski derivative. For more details see [67, 115].
Now by coinduction—remember that we are in Sets now—a G-coalgebra det(c)induces the unique map below. It assigns, to each “state” S ∈ PX, its accepted
language.
GP(Σ∗ )GPX∼
det(c)= , δ
∗
P(Σ
)
X
PX
ηP = { }Our original interest is the accepted language of each single state x ∈ X. This isobtained by the above map, by pre-composing η P : X −→ PX which yields singletons.
This much said, its relation to our general Kleisli framework is not yet clear. The
above determinization construction relies on the following ingredients:∼=– a natural isomorphism GP =⇒ PF ;– a ﬁnal G-coalgebra is carried by PA where A carries an initial F -algebra.
These assumptions already look quite strong and we are yet to see how to generalize
them.

2.5

Trace semantics as testing equivalence

In this section we will observe that, in a non-deterministic setting, the coalgebraicﬁnite trace semantics (i.e. coinduction in K(P)) gives rise to a canonical testing situation in which a test is an element of an initial F -algebra A in Sets. Here F speciﬁes
the transition type, just as before. The notion of testing situations (Deﬁnition 2.5.1)
and its variants have attracted many authors’ attention in the context of coalgebraic
modal logic; our aim here is to demonstrate genericity and pervasiveness of the notion of testing situations by presenting an example which is not much like modal logic(that is, propositional logic plus modality).
In Section 2.5.1 we introduce the notion of testing situations and investigate someof their general properties. Our main concern there is the comparison between two

2.5

Trace semantics as testing equivalence

51

process equivalences, namely testing equivalence and equivalence modulo ﬁnal coalgebra semantics. We present the equivalences categorically as suitable kernel pairs;
this makes the arguments simple and clean. In Section 2.5.2 we present the canonicaltesting situation for trace semantics. Moreover we show that it is expressive: thetesting captures ﬁnal coalgebra semantics, which is now trace semantics.

2.5.1

Testing situations

Recent studies [17, 18, 80, 84, 87, 109] on coalgebra and modal logic have identiﬁed(variants of) the following categorical situation as the essential underlying structure.
Following [109], we prefer using a more general term “testing”: it subsumes “modal
logic” in the following sense. We learn properties of a system through pass or failureof tests; modal logic constitutes a special case where tests are modal formulas.
2.5.1 Deﬁnition. A testing situation is the following situation of a contravariant
adjunction S op  P and two endofunctors F, M

F op

Cop

P

S op

A

M

(2.27)

plus a “denotation” natural transformation δ : M P ⇒ P F op : Cop → A, whichδX
P F X in A.
consists of arrows M P X −→Note that the denotation δ is a parameter: the same “syntax for tests” M : A → A
can have diﬀerent interpretations with diﬀerent δ.
The requirements in Deﬁnition 2.5.1 are the same as in [80, 109]. They are what weneed to compare two process semantics, namely testing equivalence—which arises naturally from the concept of testing—and ﬁnal coalgebra semantics.8 We shall explain
each ingredient’s role, using the well-established terminology of modal logic.
– The endofunctor F : C → C makes CoalgF the category of “systems,” or“Kripke models” in modal logic.
– The category A—typical examples being Bool of Boolean algebras or Heytof Heyting algebras—is that of “propositional logic.” The functor M speciﬁes“modality”: modal operators and axioms. Then AlgM is the category of “modal∼=
L is a “modal logic” consisting of modal
algebras”; an initial M -algebra M L →formulas, modulo logical equivalence.
8 In fact we can be even more liberal: existence of a denotation δ can be replaced by existenceof a lifting P̂ : Coalgop
F → AlgM of P . The results in this section nevertheless hold in that case.
The latter condition (there is a lifting P̂ ) is strictly weaker than the former (there is a naturaltransformation δ): obviously δ induces P̂ but not the other way round. Let C = ω op , A = ω, P =id, F = (1 + )op and M = 2 + . Then both CoalgF and AlgM are the empty category hence P
has the trivial lifting. However there is no natural transformation M P X → P F op X.

52

2 Trace semantics via coinduction– The denotation δ speciﬁes how the modality M is interpreted via transitionsof type F . This allows to give “Kripke semantics” for the modal logic: givena coalgebra (or a “Kripke model”) c : X → F X, interpretation  c of modal
formulas therein is given by the following induction.
MPX
δX
PFX
Pc
PX

ML
initial

∼
=

L

 c

(2.28)– Why a right adjoint S of P op ? It allows us, via transposition, to assign a modal“theory” to each state of a Kripke model.
L
X

 c
thc

in A

PX
SL

(S op  P )(2.29)in C

The theory thc (x) associated with a state x contains precisely the modal formulas that hold at x.
Following the above intuition, we deﬁne the categorical notion of testing equivalence:
two states are testing-equivalent if they have the same modal theory.
2.5.2 Deﬁnition. Assume that we have a testing situation (2.27), and that C hascﬁnite limits. On a coalgebra X → F X, the testing equivalence TestEqc is the kernel
pair of the theory map thc deﬁned by (2.28) and (2.29). Equivalently,
TestEqc

p1 ,p2 X ×X

thc ◦π1thc ◦π2SL(2.30)

is an equalizer.
Similarly, we introduce the categorical notion of “equivalence modulo ﬁnal coalgebra semantics”; we shall call it FCS-equivalence for short.
∼=
2.5.3 Deﬁnition. Assume that there is a ﬁnal F -coalgebra ζ : Z →F Z, and that Cc
has ﬁnite limits. On a coalgebra X → F X, the FCS-equivalence FCSEqc is the kernel
pair of the unique map beh(c) : X → Z induced by ﬁnality. Equivalently,

FCSEqcis an equalizer.

q1 ,q2 X ×X

beh(c)◦π1beh(c)◦π2Z(2.31)

2.5

Trace semantics as testing equivalence53

It is easily seen that the two “relations” TestEqc and FCSEqc on X are equivalence relations in the sense of [61, Section 1.3]. That is, they satisfy the reﬂexivity,
symmetry, and transitivity conditions when the conditions are suitably formulated in
categorical terms.
Now our concern is the comparison between two process semantics TestEqc and
FCSEqc , as subobjects of X × X. The following lemma is crucial for our investigation;in fact it is important for coalgebraic modal logic in general and appears e.g. as [80,Theorem 3.3].
2.5.4 Lemma. A morphism of F -coalgebras preserves theory maps. That is,
FX
c
X

Ff

f

FY
d
Y

implies

X
f
Y

thc
SL

thd

.

Proof. The following induction diagram proves P f ◦  d =  c . Naturality of δ
plays an important role there.
MLinitial

Ff

∼
=

L

 d

MPY
δY
PFY
Pd
PY

MPf

PFf
Pf

MPX
δX
PFX
Pc
PX .

Then the claim follows from naturality of the transposition (2.29).
We show that in a testing situation like (2.27), tests respect ﬁnal coalgebra semantics. That is, testing does not distinguish two FCS-equivalent states.
2.5.5 Proposition. Consider such a testing situation and equivalence relations ascin Deﬁnitions 2.5.2 and 2.5.3. For any coalgebra X → F X we have an inclusion
FCSEqc ≤ TestEqc
of subobjects of X × X.
Proof. It suﬃces to show that the arrow q1 , q2  in (2.31) equates the parallel arrowsin (2.30); then the claim follows from universality of an equalizer.
thc ◦ π1 ◦ q1 , q2  = thc ◦ q1
= thζ ◦ beh(c) ◦ q1
= thζ ◦ beh(c) ◦ q2
= thc ◦ q2
= thc ◦ π2 ◦ q1 , q2  .

(∗)
due to (2.31)(∗)

Here (∗) is an instance of Lemma 2.5.4: beh(c) is a morphism of coalgebras from c tothe ﬁnal ζ.
54

2 Trace semantics via coinduction

The converse TestEqc ≤ FCSEqc does not hold in general. For a ﬁxed type ofsystems (i.e. for ﬁxed F : C → C), we can think of logics with varying degree of
expressive power; this results in process equivalences with varying granularity. Thisview is systematically presented by van Glabbeek in [39] as the linear time-branchingtime spectrum—a categorical version of which we consider as an important directionof future work.
∼=
TestEqc that a modal logic (considered as a testIt is when we have FCSEqc →ing situation) is said to be expressive. Recall that FCSEqc usually coincides withbisimilarity if C is Sets: in this case an expressive logic captures bisimilarity.
The following proposition states a (rather trivial) equivalent condition for a testing
situation to be expressive. For more ingenious suﬃcient conditions—which essentiallyrely on the transpose of δ being monic—see e.g. [80].
2.5.6 Proposition. Consider a testing situation as in Deﬁnitions 2.5.2 and 2.5.3.
c
The testing is expressive, that is, for any coalgebra X → F X we have∼=
FCSEqcTestEqc →as subobjects of X × X, if and only if the theory map thζ : Z → SL for the ﬁnal
coalgebra is a mono.
Proof. We ﬁrst prove the “if” direction. In view of Proposition 2.5.5, it suﬃces toshow that p1 , p2  in (2.30) equalizes beh(c) ◦ π1 and beh(c) ◦ π2 (which proves
TestEqc ≤ FCSEqc ).
thζ ◦ beh(c) ◦ p1 = thc ◦ p1
= thc ◦ p2

by Lemma 2.5.4
due to (2.30)= thζ ◦ beh(c) ◦ p2

by Lemma 2.5.4

We have beh(c) ◦ p1 = beh(c) ◦ p2 since thζ is a mono.
To prove the “only if” direction, ﬁrst we observe that the FCS-equivalence on the∼=
F Z is the diagonal relation: that is,
ﬁnal coalgebra ζ : Z →FCSEqζ
∼=Z

Z ×Z
id,id

beh(ζ)◦π1beh(ζ)◦π2

Z.

This is because beh(ζ) = id : Z → Z. Now assume that thζ ◦ k = thζ ◦ l fork, l : Y ⇒ Z. Universality of an equalizer TestEqζ induces a mediating arrow m in
the following diagram.
Ym
TestEqζk, l
∼=FCSEqζ

beh(ζ) ◦ π1
Z ×Z
Z
beh(ζ) ◦ π2
id, id
Z
∼
=

2.5

Trace semantics as testing equivalence

55

The whole diagram commutes since TestEqζ ∼= FCSEqζ (by assumption) and FCSEqζ ∼=Z (by the above observation), both as subobjects of Z × Z. This proves k = l.

2.5.7 Remark. The literature [17, 18] considers more restricted settings than thetesting situations in Deﬁnition 2.5.1. There an adjunction S op  P is replaced bya dual equivalence of categories, and a denotation δ is required to be a natural isomorphism. These additional restrictions allow one to say more about the situations:logics are always expressive; the main concern of [18] is how to present an abstract
modal logic M : A → A by concrete syntax. However, for our purpose in Section 2.5.2
the greater generality of our notion of testing situations is needed.

2.5.2

Canonical testing for trace semantics in K(P)In this section we shall present a canonical testing situation for coalgebras in K(P).
We shall also show that the testing is “expressive,” in the sense that the testing
captures ﬁnal coalgebra semantics. The intuition is as follows.
Trace semantics for non-deterministic systems assigns to each system c its “(ﬁnite)
trace set” map tr(c) : X → PA, where A carries an initial algebra in Sets. Thissuggests a natural testing framework where: an element t of A is a test; a statex ∈ X of a system passes a test t if and only if the trace set of x includes t (i.e.
x |= t ⇐⇒ t ∈ tr(c)(x)). An important point here is that A, carrying an initial
algebra in Sets, usually gives a well-founded syntax for tests.9
We focus on a non-deterministic setting (i.e. T = P) in this section and leave aprobabilistic one as future work. Although the above intuition is true in probabilistic
settings as well—where the 2-valued (pass/failure) observation scheme is replaced by
the reﬁned [0, 1]-valued one—we do not know yet how to extend the current material
to probabilistic settings. The diﬃculty is that the category K(D) is not self-dual, as
opposed to K(P); see (2.32) below.
The canonical testing situation which captures ﬁnite trace semantics is the following one.

K(P)op
F

op

Op
∼
=
Op

op

K(P)

K

J

F
Sets

(2.32)∼=
Here J  K is the canonical Kleisli adjunction. Recall the self duality Op : K(P)op →K(P) from Section 2.3.2. The denotation is given by (the components of) the distributive law λ : F P ⇒ PF . The following lemma establishes that the denotation
thus deﬁned is indeed a natural transformation.
9 Recall the construction of an initial algebra in Sets via the initial sequence (Proposition A.1.1).
The set A is the colimit (union in Sets) of the initial sequence 0 → F 0 → F 2 0 → · · · . Each F n 0
can be thought of as the set of terms with depth ≤ n.

56

2 Trace semantics via coinduction

2.5.8 Lemma. Let F : Sets → Sets be a functor which preserves weak pullbacks,and F be its lifting induced by the relation lifting (Lemma 2.2.4). Then the comλX
PF X of the corresponding distributive law λ also form a natural
ponents F PX →transformation

F ◦ K ◦ Op =⇒ K ◦ Op ◦ F

op: K(P)op −→ Sets .

Proof. The desired natural transformation is obtained from another natural transformation
λ : F K =⇒ KF : K(P) −→ Sets
which we describe in a moment, by post-composing the functor Op. That is, thedesired one is the composite
λ ◦Op(∗)

F KOp =⇒ KF Op = KOpF

op,or equivalently, in a 2-categorical presentation,
K(P)opop

F
K(P)op

Op
(∗)
Op

K(P)
F
K(P)

K
λ
K



Sets
F
Sets .

Here the equality (∗) is the one in (2.20).
Now we describe the natural transformation λ . Its components are given by thoseof λ; naturality of λ is an easy consequence of λ’s being a distributive law. Indeed,
given an arrow f : X → Y in K(P), the following shows that the naturality squarecommutes.
KF f ◦ λX = μP
F Y ◦ PF f ◦ λX

deﬁnition of K

= μP
FY
= μP
FY

◦ PλY ◦ PF f ◦ λX

deﬁnition of F

◦ PλY ◦ λPY ◦ F Pf

naturality of λ= λY ◦ F μP
Y ◦ F Pf

λ is compatible with multiplication μP= λY ◦ F Kf

deﬁnition of KThe previous lemma establishes that the situation (2.32) is indeed a testing situation
as deﬁned in Deﬁnition 2.5.1.
In the previous Section 2.5.1, the use of testing situations is demonstrated throughcomparing testing equivalence and ﬁnal coalgebra semantics, both described as suitable kernel pairs. Unfortunately this argument is not valid in the current situation (2.32), since the category K(P) does not have kernel pairs.
Still, we shall claim that the situation (2.32) is “expressive,” in the sense that ﬁnal
coalgebra semantics is captured by testing. This claim is supported by the following
fact: in the current situation the two arrows tr(c) and thc simply coincide. Therefore
their kernel relations—in any reasonable formalization—should coincide as well.

2.5

Trace semantics as testing equivalence57c

2.5.9 Proposition. Let X → F X be a coalgebra in K(P). In the testing situation(2.32), the following arrows in K(P) coincide.
– tr(c) : X → A, giving the ﬁnal coalgebra (trace) semantics for c.
– thc : X → A, giving the testing semantics, i.e. the set of passed tests.
Therefore the testing is “expressive”: tests from an initial F -algebra captures trace
semantics (which is via a ﬁnal F -coalgebra).
Here A is the carrier of an initial F -algebra, hence that of a ﬁnal F -coalgebra. Note
that, in the general setting in Section 2.5.1, the codomains of tr(c) and thc need notcoincide.
Proof. We shall show that the transposetr(c)∨ : A −→ PX

in Setsof tr(c) under the adjunction in (2.32) makes the diagram (2.28)—which deﬁnes  c —∨commute. This proves tr(c)∨ =  c , hence tr(c) =  c = thc .
First note that the transpose tr(c)∨ : A → PX, when it is thought of as an arrowin K(P), coincides with the arrow Op(tr(c)) : A → X. In the sequel we shall write
Op(tr(c)) for tr(c)∨ .
Commutativity of the diagram (2.21)—deﬁning tr(c)—yields the following equality.
opin K(P).
Op(tr(c)) ◦ Op(Jα−1 ) = Op(c) ◦ Op(F tr(c))
By the deﬁnition of composition in K(P), it reads as follows in Sets.
μX ◦ P(Op(tr(c))) ◦ Op(Jα−1 ) = μX ◦ P(Op(c)) ◦ Op(Fop

tr(c))(2.33)We use this equality in showing that Op(tr(c)) makes the diagram (2.28) commute.
Op(tr(c)) ◦ α = μX ◦ ηX ◦ Op(tr(c)) ◦ α= μX ◦ P(Op(tr(c))) ◦ ηA ◦ α= μX ◦ P(Op(tr(c))) ◦ Op(Jα−1 )= μX ◦ P(Op(c)) ◦ Op(Fop

tr(c))

unit law
naturality of ηOp(Jα−1 ) = Jα = ηA ◦ αby (2.33)
op= μX ◦ P(Op(c)) ◦ F Op(tr(c))

OpF= μX ◦ P(Op(c)) ◦ λX ◦ F Op(tr(c))= KOp(c) ◦ λX ◦ F Op(tr(c)) .

deﬁnition of F

= F Op, (2.20)

Recall that M in (2.28) is now F ; P in (2.28) is now KOp. This concludes the proof.
The proposition establishes a connection between two semantics for F -coalgebrasin K(P), namely: tr(c) via a ﬁnal F -coalgebra, and thc via an initial F -algebra. One
may well say that it is a “degenerate” case because, as we have shown in Section 2.3,

58

2 Trace semantics via coinductioncoinduction in K(P) and induction in Sets are essentially the same principle. Ouremphasis is more on the fact that the coincidence of induction and coinduction yields
a rather uncommon example of testing situations. Testing situations are of interest
in modal logic—where the underlying contravariant adjunction S op  P : A → Cop
in (2.27) is often the Stone duality or one of its variants. Our example K(P)op  Sets
here does not look like one of those familiar examples.

2.6

Summary and future work

We have developed a mathematical principle underlying “trace semantics” for various
kinds of branching systems, namely coinduction in a Kleisli category. This generalview is supported by a technical result that a ﬁnal coalgebra in a Kleisli category is
induced by an initial algebra in Sets.
The possible instantiations of our generic framework include non-deterministic
systems and probabilistic systems, but do not yet include systems with both nondeterministic and probabilistic branching. The importance of having both of thesebranchings in system veriﬁcation has been claimed by many authors e.g. [120, 137],
with an intuition that probabilistic branching models the choices “made by the system, i.e. on our side,” while (coarser) non-deterministic choices are “made by the(unknown) environment of the system, i.e. on the adversary’s side.” A typical example of such systems is given by probabilistic automata introduced by Segala [120].
In fact this combination of non-deterministic and probabilistic branching is a notoriously diﬃcult one from a theoretical point of view [26, 132, 136]: many mathematical
tools that are useful in a purely non-deterministic or probabilistic setting cease to workin the presence of both. For our framework of generic trace semantics, the problem
is that we could not ﬁnd a suitable monad T with an order structure.
We have used the order-enriched structure of a Kleisli category (expressing “morepossibilities”) to obtain the initial algebra-ﬁnal coalgebra coincidence result. However, an order structure is not the only one that can yield such coincidence: otherexamples include metric, quasi-metric and quantale-enriched structures (in increasing
generality). See e.g. [32, 135] for the potential use of such enriched structures in a
coalgebraic setting. The relation of the current work to such structures is yet to beinvestigated.
In the discipline of process algebra, a system is represented by an algebraic term(such as a.P  a.Q) and a structural operational semantics (SOS) rule determines its
dynamics, that is, its coalgebraic structure. This is where “algebra meets coalgebra”
and the interaction is studied e.g. in [12, 78, 134]. Later in chapter 5 we will claim
the importance of the microcosm principle in this context and provide a “generalcompositionality theorem”: under certain assumptions, ﬁnal coalgebra semantics is“compositional” in a suitable sense. The results of the current chapter say that ﬁnal
coalgebra semantics can be interpreted as ﬁnite trace semantics (besides bisimilarity); hence the result in Chapter 5 instantiates to a compositionality result for trace
semantics.

2.6

Summary and future work59

We have included some material—on possibly-inﬁnite traces and testing situations—which, unfortunately, we have worked out only in a non-deterministic setting. A fully
general account of these topics is left as future work.
Finally, there are so many diﬀerent process semantics for branching systems, between two edges of bisimilarity and trace equivalence in the linear time-branchingtime spectrum [39]. How to capture them in a coalgebraic setting is, we believe, an
important and challenging question.

60

2 Trace semantics via coinduction

Chapter 3
Generic forward and backward simulations

The technique of forward/backward simulations has been applied successfully in veriﬁcation of distributed/concurrent systems. In this chapter, however, we claim thatthe technique has more potential generality and mathematical clarity. We do soby identifying forward/backward simulations as lax/oplax morphisms of coalgebras.
Following this observation, we present a systematic study of this generic notion of simulations. It is meant to be a generic version of the study by Lynch and Vaandrager,
covering both non-deterministic systems and probabilistic systems. In particular we
prove soundness and completeness results for simulations with respect to trace inclusion: the proof is by coinduction using the generic theory of traces developed in theprevious chapter. By suitably instantiating our generic framework, one obtains anappropriate deﬁnition of forward/backward simulations for a variety of systems, forwhich soundness and completeness come for free.

3.1

Overview

The theory of forward/backward simulations for non-deterministic automata has been
extensively studied due to its signiﬁcance in system veriﬁcation (as described in Chapter 1). A notable example is a systematic study by Lynch and Vaandrager [94]. The
technique of forward/backward simulations has been applied successfully in many distributed and concurrent applications, described as transition systems. For example,
in [71] trace-based anonymity properties for network protocols are proved by building backward simulations. The notions of forward/backward simulations are also
extended to diﬀerent kinds of state-based systems such as probabilistic ones [120].
We claim that the theory of forward/backward simulations has more potential
generality and mathematical clarity. We do so by revealing a simple mathematicalstructure hidden behind various notions of simulations deﬁned for diﬀerent kinds ofsystems. The slogan is: a forward/backward simulation is a lax/oplax morphism of61

62

3 Generic forward and backward simulations

coalgebras in a Kleisli category.
In K(T )

Ff

FX
c
X

FY
d
Y

FX
c
X

f
lax coalgebra morphism= forward simulation

Ff

FY
d
Y



f
oplax coalgebra morphism= backward simulation(3.1)

An arrow f in (3.1) is called a lax/oplax morphism of coalgebras because it satisﬁes
a condition which is similar to the one for a morphism of coalgebras, but has aninequality in the square (instead of an equality—which we usually do not put explicit).
FX
c
X

Ff
=

FY
d
Y

f
morphism

FX
c
X

Ff

FY
d
Y

f
lax morphism

FX
c
X

Ff


FY
d
Y

f
oplax morphism

The use of categorical terms allows us to put various constructions in a mathematically
clearer way. For example, the informal “duality” between forward and backward
simulations is now put explicit, in the form of reversed inequalities ( vs. ) in (3.1).
Based on this observation, we aim at presenting a generic version of the systematic
study [94]. We employ the generic theory of traces in Chapter 2 and show:– Soundness. Existence of a forward/backward/hybrid simulation from a system
S to T implies trace inclusion tr(S)  tr(T ).
– Completeness. Trace inclusion implies existence of a certain kind of hybrid
simulation, namely a backward-forward simulation.
Our generic, coalgebraic theory of forward/backward simulations in this chapter
is built on top of the theory of trace semantics in Chapter 2. The mathematicalsetting stays the same: we work with F -coalgebras in the category K(T ), where afunctor F : K(T ) → K(T ) is a lifting of F : Sets → Sets. Just like in Chapter 2,
we understand the functor F as a speciﬁcation of “transition type”; the monad T
as a speciﬁcation of “branching type.” Moreover, the order  in (3.1) refers to the
Cppo-enriched structure of the Kleisli category, as the “more possibilities” orderthat we exploited in Chapter 2. The conditions imposed on these F and T remain thesame. This results in the same (wide) variety of possible choices of parameters F and
T , hence in the same applicability. In particular, our generic theory of simulations
covers both non-deterministic systems as well as purely probabilistic systems (but not
systems with both non-determinism and probability—as in Chapter 2).
For a variety of systems, our generic theory of simulations gives a deﬁnition of
forward/backward simulations tailored to the speciﬁc kind of systems, as an instantiation of the coalgebraic deﬁnition (3.1). The resulting deﬁnition is (at least) a “useful”

3.2

Coalgebraic forward and backward simulations

63

one, since for these simulations a soundness theorem comes for free. Soundness plays
a crucial role in the simulation-based veriﬁcation technique of trace-based properties(see Chapter 1); we will prove generic soundness theorems parametrized by F and T ,once for all.
Now let us take the viewpoint of a coalgebra theorist. This chapter continues
investigation of coalgebras in a Kleisli category which we started in Chapter 2, ﬁllingin the lower middle cell in the following table.
In Sets
In K(T )3.1.1

morphism of coalgebras
functional bisimulation
lax · · · forward simulation
oplax · · · backward simulation[this chapter]

coinduction gives
bisimilarity
trace semantics[Chapter 2]

Bibliographical remarks

The novelty in this chapter is to identify lax/oplax coalgebra morphisms in a Kleisli
category as forward/backward simulations. This view—with three keywords lax morphism, Kleisli and simulation—seems new to the best of our knowledge. However, aclose relationship between lax morphisms and simulations (not necessarily in a Kleisli
category) has been pointed out or hinted by many authors.
The work [139] uses lax/oplax coalgebra morphisms in obtaining a coalgebraic
representation of the Cone of Inﬂuence reduction. The key observation there is,for coalgebras in Sets with their signature F = P, a graph of a lax morphism is asimulation. The work [32, 135] formulate what they call ordered categorical bisimulations using lax coalgebra morphisms. The notion of ordered categorical bisimulations“resembles the notion of bisimulation up to” [32]; this comes close to simulations.
Additionally, the work [21] describes users’ visit to a website in two ways—namely asa suitable simulation and as a lax coalgebra morphism—hinting conceptual closenessbetween the two notions.
Besides, there are work that we are aware of which focuses on one of the three
keywords listed above. For example, the work [58, 64] presents a coalgebraic formulation of simulations which is diﬀerent from ours, starting from a given order structure
in a signature functor F . The work [56, 76] investigates use of lax categorical structures in computer science. Details about these references, together with comparisonof our notion of probabilistic simulations to some existing deﬁnitions, are found in
Section 3.4.

3.2

Coalgebraic forward and backward simulations

In this section we introduce our coalgebraic presentations of forward and backward
simulations. It turns out that, in deﬁning these coalgebraic simulations, it is more
appropriate to make start states explicit, although start states are usually left implicitin the study of coalgebras.

64

3 Generic forward and backward simulations

Therefore in Section 3.2.1 we start with introducing the notion of coalgebras ina Kleisli category accompanied with their (explicit) start states; this notion we shallcall (T, F )-systems. In Section 3.2.2 the coalgebraic notion of (ﬁnite) trace semantics
from Chapter 2 is extended to (T, F )-systems in a natural way. Section 3.2.3 presents
our core deﬁnition of coalgebraic forward/backward simulations; in Section 3.2.4 we
explain why we need to make start states explicit.

3.2.1(T, F )-systems

For the reason we will discuss later in Section 3.2.4, in this chapter we shall work withcoalgebras in K(T ) which additionally have explicit start states. When one think of“(a) start state(s)” of a branching system, there are two diﬀerent possible approaches.
1. One single state of the system is its starting state. That is, there is no branchingin choosing a start state.
2. There is branching in choosing a start state. If the system in question is nondeterministic, the notion of “start states” should be given by the set of thosestates which can possibly be chosen as an initial state of an execution. If thesystem is probabilistic then the notion of “start states” is given by a probability(sub)distribution over the state space—describing with what probability a stateis chosen as an initial state of an execution.
These two approaches are equivalent in practice. The ﬁrst (non-branching) “start
state” is turned into the second kind by regarding it as a trivial branching; converselya system with the second (branching) kind of “start states” is turned into a systemwith the ﬁrst kind of “start states” by adding a fresh “start state” (◦ below) andtransitions from it.
x0

···
−→

x1

x0

···

x1

···

◦

···

We shall take the second approach (“branching start state”) since it is betteraccommodated in our setting in a Kleisli category. Speciﬁcally, let X be the set ofstates. A (branching) start state map is given by an arrows

1 −→ Xsin K(T ) ,which is the same thing as an arrow 1 → T X in Sets, hence as an element s ∈ T X.
When our system is non-deterministic (T = P) the arrow s is hence a subset of X;
when it is probabilistic (T = D) the arrow s gives us a probability subdistribution
over the set X. This matches the intuition described above.
s
This notion of start state maps 1 → X is combined with coalgebras to give ourpresentation of state-based systems.

3.2

Coalgebraic forward and backward simulations

65

3.2.1 Deﬁnition ((T, F )-systems). Let T be a monad and F be an endofunctor,
both on Sets. Assume further that F : Sets → Sets has a lifting F : K(T ) → K(T )in the sense of the diagram (2.11).
A (T, F )-system is a pair of arrows
FX
c
X
s
1

in the Kleisli category K(T ) ,which is the same thing as a pair of functions
 TX
TFX 
c
s ,
1
X

in Sets ,recalling that F X = F X for a lifting F . The arrow s is called the start state map,and the F -coalgebra c is called the dynamics. The set X is called the state space.
The only element of the singleton 1 appearing here is denoted by ∗.1
3.2.2 Example (LTSs with explicit termination). Let us take T = P and F =1 + Σ × , in which case an F -coalgebra in K(T ) is a functioncX −→ P(1 + Σ × X)

in Setsmodeling an LTS with explicit termination such as the leftmost one in (2.1). The
monad T = P models non-deterministic branching; the endofunctor F = 1 + Σ ×sets the transition type of “terminate, or (output and proceed).”In this setting, a (T, F )-system—i.e. (P, 1+Σ× )-system—is an LTS with explicit
terminationcin Sets
X −→ P(1 + Σ × X)
plus an explicit start state map
1
1

s

−→ X
s

−→

in K(P)PX in Setss⊆X .

When the leftmost system in (2.1) is accompanied by a start state map s(∗) = {x, y},it means that both states x and y can potentially become an initial state of an
execution.
a
y
x
b

1 Throughout Chapters 2 and 3 we have three diﬀerent singletons with diﬀerent meanings:(in F = 1 + Σ × ) for successful termination; {⊥} (in T = L = 1 +denote start states.

{}) for deadlock; and {∗} to

66

3 Generic forward and backward simulations

3.2.3 Example (Probabilistic LTSs with explicit termination). Let us replace T = P
in the previous example by T = D, the subdistribution monad, in which case we haveprobabilistic branching. A (T, F )-system is an F -coalgebracX −→ D(1 + Σ × X)

in Setssuch as the probabilistic system in the middle of (2.1), augmented with a start state
map
1
1

s

−→ X
s

−→

An example of such s iss(∗) =in K(D)DX in Setss ∈ DX .
x
y

→
→



1/3
2/3

,

which we can depict as follows.
[ 13 ]x

a[ 13 ]

a[ 13 ]
a[1][ 23 ]
y
1
2

1
3

z

a[ 12 ]



3.2.4 Remark. In category theory, an arrow in a category from a terminal object toan object X is often called a point in X. It is so because in Sets (where a singleton
1 is terminal) we have the following correspondence.
x

1 −→ X in Sets
an element x ∈ X
sIn the current setting, a start state map 1 → X is not a point in this sense, since its
domain 1 is not a terminal object in K(T ).2
Nevertheless the object 1 ∈ K(T ) has a special status as a unit of a symmetricmonoidal category K(T ). Speciﬁcally, when the monad T in question is commutative(Section 2.2), its Kleisli category K(T ) has a canonical commutative tensor (see [60,Theorem 4.3] or an abstract treatment later in Section 5.5.1). This tensor acts on
objects as products hence has 1 as its neutral object. Consequences of this status of
1 in K(T ) are yet to be investigated.
2 The empty set 0 is terminal in a setting of our interest, that is, when K(T ) is Cppo-enriched(Lemma 2.3.5).

3.2

3.2.2

Coalgebraic forward and backward simulations

67

Trace semantics for (T, F )-systems

In Chapter 2 we introduced the scheme of (ﬁnite) trace semantics for F -coalgebras ina Kleisli category K(T ). It extends naturally to (T, F )-systems.
Let us make a brief review. Given a coalgebra c : X → F X in K(T ), where thefunctor F is a lifting of F : Sets → Sets, we obtain its (ﬁnite) trace semantics via
coinduction.
F (tr(c))
FX
FA∼
in K(T )c= Jα−1X
A
tr(c)Speciﬁcally, a coalgebra c is assigned the unique morphism tr(c) going into a ﬁnal
F -coalgebra Jα−1 (which is given by an initial F -algebra in Sets). The resulting
arrow is, as a function, of the typetr(c) : X −→ T A

in Sets.

This (set-theoretic) function carries each state x ∈ X to a “set of” (or “probability
subdistribution on,” etc. depending on the choice of T ) linear-time behaviors which
are elements of A.
Now that we have an explicit start state map s : 1 → X (in K(T )), the tracescsemantics of a (T, F )-system 1 → X → F X is naturally deﬁned as the compositionof tr(c) : X → A after s : 1 → X, taken in K(T ).
3.2.5 Deﬁnition (Finite trace semantics of (T, F )-systems). Let (F, T, λ) be a tracescsituation (Theorem 2.3.3). Given a (T, F )-system 1 → X → F X in K(T ), its (ﬁnite)
trace semantics tr(s, c) is the following composite.
In K(T )F (tr(c))
FX
c
X
s
1

tr(c)

FA
∼ Jα−1=Atr(s, c)αHere F A → A is an initial algebra in Sets; J : Sets → K(T ) is the standard Kleisli
left adjoint.
This deﬁnition indeed gives what we expect from “trace semantics taking start
states into account,” as the following examples illustrate.
3.2.6 Example. Let us take T = P modeling non-deterministic branching. As wesaw in Example 3.2.2, a start state map s : 1 → X (in K(P)) is identiﬁed as a subsets(∗) of X; it is seen as the set of possible initial states.

68

3 Generic forward and backward simulationsc

In this case, a natural interpretation of “trace semantics of the system X → F X
starting from s” is the union'tr(c)(x)x∈s(∗)of the possible linear-time behaviors tr(c)(x), taken over all the possible initial statesx ∈ s(∗). The composite tr(s, c) = tr(c) ◦ s in Deﬁnition 3.2.5 indeed yields thisunion:str(c)1 −→ X −→ A

in K(P)sP(tr(c))μP

A1 −→ PX −→ PPA −→PA in Sets'
tr(c)(x) .
which carries∗ ∈ 1 to=x∈s(∗)

Recall that the multiplication μP for the powerset monad is given by unions.
3.2.7 Example. Let us take T = D, the subdistribution monad, to model probabilistic branching. A start state map s : 1 → X (in K(D)) is identiﬁed with a probability
subdistribution s(∗) ∈ DX such as in Example 3.2.3.
It is easy to see that the trace semantics of a (T, F )-systemtr(s, c) : 1 −→ A
in K(D)tr(s, c) : 1 −→ DA in Sets
carries ∗ ∈ 1 to the probability subdistribution()"
u ∈ A −→
s(x) · tr(c)(x)(u) ,x∈Xthat is,
(
u∈A

−→

"

*

exec. of c, starting from x, yields u
Pr(init. state is x) · Pr
asits linear-time behavior
x∈X

+

)
.

This probability assigned to a behavior u ∈ A can be justiﬁably called the probability
with which “the system (s, c) yields u as its linear-time behavior.”

3.2.3

Forward and backward simulations

Now let us present the key observation in this chapter, namely the identiﬁcation oflax/oplax morphisms of coalgebrasasforward/backward simulations.

Throughout the rest of this chapter, we assume that (F, T, λ) is a trace situation, thatis, it satisﬁes the conditions in Theorem 2.3.3 on trace semantics.

3.2

Coalgebraic forward and backward simulations
s

c

t

69

d

3.2.8 Deﬁnition (Forward simulations). Let 1 → X → F X and 1 → Y → F Y be
(T, F )-systems, presented in K(T ).
A forward simulation from (t, d) to (s, c) is an arrow f : X → Y in K(T ) suchthat:t  f ◦ s and d ◦ f  F f ◦ c ,that is,In K(T )

Ff
FX
c
X
s
1

f

FY
d
Y
t
1

(3.2)
,

where  refers to the DCpo⊥ -enriched structure of the Kleisli category K(T ) which
we assume to be present; see Section 2.2.3.
We write (t, d) F (s, c) if there is a forward simulation from (t, d) to (s, c). The
relation F is called the forward similarity relation.
Therefore, to be precise, a forward simulation is a lax morphism of coalgebras
Ff
FX
c
X

f

FY
d
Y

which satisﬁes an additional inequality regarding start state maps (the lower squarein (3.2)).
A “dual” notion of forward simulations, with the inequalities reversed (but not
the directions of arrows), is that of backward simulations.
s

c

t

d

3.2.9 Deﬁnition (Backward simulation). Let 1 → X → F X and 1 → Y → F Y be
(T, F )-systems, presented in K(T ).
A backward simulation from (s, c) to (t, d) is an arrow f : X → Y in K(T ) suchthat: f ◦ s  t and F f ◦ c  d ◦ f . That is,
In K(T )

Ff
FX
c
X
s
1


f


FY
d
Y
t
1

(3.3)
.

We write (s, c) B (t, d) if there is a backward simulation from (s, c) to (t, d). It iscalled the backward similarity relation.

70

3 Generic forward and backward simulations

In the context of data reﬁnement, lax natural transformations are used to formulate simulations between interpretations of a programming language [56, 76]—notethat those “simulations” are not the ones (between state-based systems) that we are
currently investigating. In a coalgebraic setting, [32] uses lax morphisms to investigate order-enriched version of bisimulations. However, to the best of our knowledge,
the signiﬁcance of lax/oplax morphisms in Kleisli categories is ﬁrst emphasized here.
When an arrow f : X → Y makes the diagram (3.2) or (3.3) commute—i.e.
equalities hold in place of inequalities—the arrow f will be called a morphism of
systems.
s

c

t

d

3.2.10 Deﬁnition. Let 1 → X → F X and 1 → Y → F Y be (T, F )-systems,presented in K(T ). An arrow f : X → Y is a morphism of (T, F )-systems from (s, c)to (t, d), if the following diagram commutes.
In K(T )

Ff
FX
c
X
s
1

f

FY
d
Y
t
1

(3.4)
.

3.2.11 Remark. Note the directions of arrows and inequalities in the deﬁnition of
forward/backward simulations. Speciﬁcally, in (3.2) the system (t, d) is simulated by(s, c) via f . In (3.3)—where the “simulation” arrow f has the same direction from X
to Y but the inequalities are reversed—the system (s, c) is simulated by (t, d) via f ,with the roles of the two systems exchanged.
A general rule here is that the system appearing on the smaller side of the inequalities is the system which is simulated by the other system. The coming examples will
clarify this intuition.
Let us justify our coalgebraic deﬁnition of forward/backward simulations. We shalldo so by showing that the coalgebraic deﬁnition instantiates to the conventional deﬁnition of (non-deterministic) simulations, when the parameters T and F are suitablychosen.
3.2.12 Example (LTSs with explicit termination). In the setting of Example 3.2.2,
namely T = P and F = 1 + Σ × , an arrow X → Y in K(T ) is identiﬁed with abinary relation R from X to Y .
X −→ Yin K(P)X −→ PY in Sets
R ⊆ X × Y, binary relation
In this case, Deﬁnition 3.2.8 is instantiated as follows. A relation R ⊆ X × Y is a for-

3.2

Coalgebraic forward and backward simulations

71

ward simulation from (t, d) to (s, c), if and only if it satisﬁes the following conditions.
y ∈ start(t,d)
xRy ∧ y →d axRy ∧ y →d y ∃x ∈ start(s,c) . xRy ,x →c  , a∃x ∈ X.
x →c x ∧ x Ry  .

=⇒
=⇒
=⇒

Here start(s,c) denotes the set s(∗) of the possible initial states of the system (s, c);aand x →c x denotes the fact that (a, x ) ∈ c(x), i.e. x ∈ X can make an a-move tox in the system c. Hence the ﬁrst line is concerned with initial states; the secondline with termination; and the last line with “output and continue” type transitions.
Among them we consider the third one as a core condition for simulations, and it
is exactly the same as the one in the standard literature [94]. So is the ﬁrst one on
initial states.3
The third line draws special attention because it is the conventional deﬁnition of
forward simulations between LTSs (without explicit start states or explicit termination). It works indeed “forwards,” as illustrated below.

R

a

∃x
R
a 
y

x

x
=⇒
y a yRyc

in X → F X(3.5)
din Y → F Y

Let us further illustrate how this well-known condition arises from the diagram (3.2).
x

a

→

x

FR

a

→

FY

c

x
.
.
.R
y

(†)
=
⇐

FX
c

x

FR

x
.
.
R.
y

a

→

d

y

(∗)
(3.6)

d
X
x

R

Y

R
x
.
.
R.
y

First imagine that we take the path d ◦ R from X, i.e. ﬁrst to the right then upwards.
By going along R we ﬁnd a state y ∈ Y such that xRy; then by going along d, theastate y makes a transition in d namely y → y  . This yields the situation (∗) above.
3 The three conditions here diﬀer from the deﬁnition in [94] in the following respects: terminationand internal actions. More speciﬁcally, the second line here is missing in [94] since explicit termination
is not considered there. The condition we have here is a natural one since, intuitively, xRy means“x can simulate what y can do.” We do not consider internal τ -actions (while [94] does); coalgebraic
treatment of internal actions is known to be hard and we leave it as future work.

72

3 Generic forward and backward simulations

Look at the other path F R ◦ c (upwards, then to the right). First the state x ∈ Xamakes a transition x → x in c; then by going along F R (the “lifting” of the relationR) the successor x is related to some y  ∈ Y via R. This results in the situation (†).
Finally, the inequality in the diagram postulates d ◦ R  F R ◦ c, that is, in case
we have the situation (∗) we need to have (†) as well. Hence the implication =⇒ inthe above diagram (3.6); it requires us to be able to ﬁnd a state x in the situation(†). This is precisely the conventional deﬁnition (3.5).
Similarly, a relation R from X to Y is a backward simulation (Deﬁnition 3.2.9)
from (s, c) to (t, d) if and only if:
x ∈ start(s,c) ∧ xRy
x →c 
ax →c x ∧ x Ry y ∈ start(t,d)
 ,∃y ∈ Y.
xRy ∧ y →d  ,a∃y ∈ Y.
xRy ∧ y →d y  .

=⇒
=⇒
=⇒

The third condition here works “backwards”:
a

x

x
R

y

a

x
R
R
a 
∃y
y
x

=⇒

c

in X → F X(3.7)
din Y → F Y

which arises from the diagram (3.3) in the following way.
x

a

→

x

FR

a

→

FY



c

x
.
.
.R
y

(†)
=⇒

FX
c

x

FR

x
..
R.
y

a

→

y

(∗)

d
d

X
x

R

Y

R
x
.
.
R.
y

The only diﬀerences from the diagram (3.6) is that the inequality is reversed and sois the implication =⇒. The reversed implication (†) =⇒ (∗) yields (3.7).
3.2.13 Example (Probabilistic LTSs with explicit termination). Let us see what
arises from the generic deﬁnition (Deﬁnitions 3.2.8 and 3.2.9), if the systems haveprobabilistic branching (by taking T = D). We consider the same transition-type
F = 1 + Σ × . Recall from Example 3.2.3 that (T, F )-systems, say (s, c) and (t, d),3.2

Coalgebraic forward and backward simulations73

are thought of as probabilistic LTSs with explicit termination  and an explicit start
state distribution.
A forward simulation from (t, d) to (s, c) is a function f : X → DY in Sets which
satisﬁes the following conditions.
t(∗)(y)""≤s(∗)(x) · f (x)(y)x∈Xf (x)(y) · d(y)() ≤ c(x)()

y∈Y
"

"

y∈Y

x ∈X

f (x)(y) · d(y)(a, y  ) ≤(3.8)

c(x)(a, x ) · f (x )(y  )The third line can be rephrased as follows. It can be a bit more intuitive.
⎛"y∈Y

Pr(x  y) · Pr(y → y  ) ≤
a

"
x ∈X

Pr(x → x ) · Pr(x  y  )
a

⎜
⎝cf.

x

a

x

y a y

⎞⎟⎠where a function f : X → DY is thought of as a “probabilistic transition” from X to
Y and the value f (x)(y) is denoted by Pr(x  y). The generic deﬁnition of backward
simulations can be instantiated in a similar manner.
One may wonder why we can call such a function f : X → DY a “forward simulation.” In particular, our “probabilistic simulations” are no longer binary relations
between state spaces. We have two justiﬁcations for the notion.
– The authenticity of our “probabilistic simulations” is supported by the way itarises: it is an instantiation of the generic, coalgebraic simulations which yields
conventional simulations in a non-deterministic setting.
– Our view on forward/backward simulations in this thesis is that they are tools
for establishing trace inclusion, hence for showing a system’s satisfaction of sometrace-based property. Such a scenario has been demonstrated in Section 1.4.
Therefore we do not care much if our “simulation” is a binary relation or not.
Our emphasis is instead on a soundness property which ensures usefulness of
our “simulation.” Indeed, we will later prove general soundness results (Theorem 3.3.2) which instantiates to the soundness property for our “probabilistic
simulations.” Moreover we will use them in verifying probabilistic trace-based(anonymity) properties later in Chapter 4.
Later in Section 3.4.3 our notion of “probabilistic simulations” (as an instantiation of
the coalgebraic simulations) is compared with existing notions of (bi)simulations forprobabilistic systems.

74

3 Generic forward and backward simulations

Although forward and backward simulations will be shown to be sound (Theorem 3.3.2), they fail to be complete in general.
∃ (forward or backward simulation from X to Y)
× completenesssoundness(trace sem. for X )  (trace sem. for Y)
A completeness result will be proved for a certain combination of forward and backward simulations. In [94] various combinations of forward and backward simulations
are called hybrid simulations and their completeness properties are proved. Here weshall focus on the following kind of hybrid simulations.
sct

3.2.14 Deﬁnition (Backward-forward simulations). Let 1 → X → F X and 1 →dY → F Y be (T, F )-systems. A backward-forward simulation from (s, c) to (t, d)consists ofrb– an intermediate system 1 → U → F U ;– a backward simulation f from (s, c) to (r, b), and– a forward simulation g from (r, b) to (t, d).
Diagrammatically presented in K(T ) (note the direction of arrows and inequalities),
Ff
FX
c
X
s
1


f


Fg
FU
b
U
r
1


g


FY
d
Y
t
1

(3.9)
.

We write (s, c) BF (t, d) if there is a backward-forward simulation from (s, c) to(t, d) (backward-forward similarity). Obviously,(s, c) BF (t, d)

3.2.4

⇐⇒

∃(r, b).

(s, c) B (r, b) ∧ (r, b) F (t, d). (3.10)

Why explicit start states?
s

We shall explain the reason why we need an explicit start state map 1 → X incorporated in the notion of (T, F )-systems. It has much to do with the general phenomenon
thata morphism of coalgebras preserves a behavior (given by coinduction),3.2

Coalgebraic forward and backward simulations

75

an idea we informally introduced in Section 1.3.1.
∼=
Speciﬁcally, assume that an endofunctor F : C → C has a ﬁnal coalgebra ζ : Z →F Z. If there is a morphism of coalgebras
Ff

FX
c
X

f

FY
d
Y

then f preserves a behavior given by coinduction. That is,beh(d) ◦ f = beh(c) .

(3.11)

This fact follows immediately from coinduction (proof principle). Soundness results(Theorem 3.3.2) are in the same spirit: it is about relating (possibly relaxed versionsof) morphisms with behaviors by coinduction.
The resulting “behavior preservation” (3.11) has an immediate interpretation in
the category Sets. It means: for each state x ∈ X we havebeh(d) f (x) = beh(c)(x) ,that is, the state f (x) ∈ Y has the same behavior (modulo bisimilarity) as x ∈ X.
However, when we work in a Kleisli category K(P), the equality (3.11) is no longer
intuitive. For illustration let us take T = P, the powerset monad. In (3.11) the arrows
beh(c) and beh(d) give trace (set) semantics; the arrow f has, as a function, the typef : X → PY . Equality means: for each x ∈ X,'

beh(d)(y) = beh(c)(x) .

(3.12)y∈f (x)That is, the state x has more behavior than any state y ∈ f (x), but at the same time
any behavior of x is simulated by some y ∈ f (x). It is not easy to see signiﬁcance of
this equality.
The clumsiness here lies in comparing “one x vs. many y’s.” Introducing explicit
start states is how we mend it: the following observation is an adaptation of theprevious “behavior preservation” result, so that it takes start states into account.
s

c

t

d

3.2.15 Proposition. Let 1 → X → F X and 1 → Y → F Y be (T, F )-systems,presented in K(T ).
If f : X → Y is a morphism of (T, F )-systems from (s, c) to (t, d) (Deﬁnition 3.2.10), then trace semantics for the two systems is the same:
tr(s, c) = tr(t, d) .

(3.13)

76

3 Generic forward and backward simulations

Proof. We have the following situation.
F (tr(d))

Ff
FX
c

f

X
s
1

FY
d
Y
t
1

tr(d)

FA
∼ Jα−1=A

tr(t, d)The claim is shown by an easy calculation.
(∗)

tr(t, d) = tr(d) ◦ t = tr(d) ◦ f ◦ s = tr(c) ◦ s = tr(s, c) ,where the equality (∗) is due to coinduction.

The meaning of the equality (3.13) is intuitive and clear: when T = P it means'x∈s(∗)

beh(c)(x) ='beh(d)(y) .

y∈t(∗)The diﬀerence from (3.12) is that we are now comparing “many x’s vs. many y’s,”with the help of explicit start states.

3.3

Soundness and completeness theorems

In this section we present the main results in this chapter, namely soundness andcompleteness theorems which relate forward/backward simulations (as lax/oplax morphisms of coalgebras) and trace semantics (as given by coinduction). The soundness
results possibly reduce the task of proving trace inclusion to ﬁnding a simulation—
the former involves looking ahead arbitrary many steps, while the latter involves only
one-step transitions. Hence soundness plays a central role in simulation-based veriﬁcation methods for trace-based properties, some examples of which will be presented
later in Chapter 4.

3.3.1

Order-theoretic universality of a final coalgebra in K(T )We have already observed that a morphism of (T, F )-systems preserves trace semantics (Proposition 3.2.15); its proof was essentially by coinduction. In the soundness results we will relate trace semantics (by coinduction) with forward/backward
simulations—which are lax/oplax morphisms and hence involve the order structure ofK(T ). Hence in the proofs (by coinduction) we will need an order-theoretic universal
property of a ﬁnal coalgebra in K(T ) besides its ﬁnality in a usual sense; it is givenby the following result.

3.3Soundness and completeness theorems

77

3.3.1 Proposition (Trace semantics as the largest lax morphism). Assume that
(F, T, λ) is a trace situation (Theorem 2.3.3). An arbitrary F -coalgebra c : X → F X
gives rise to its trace semantics tr(c) : X → A given by the following coinduction.
In K(T )F (tr(c))
FX
c
X

tr(c)

FA
∼ Jα−1=
A

Note that an equality = is implicit in the middle of the diagram. Hence the arrowtr(c) is both a lax morphism and an oplax morphism from c to Jα−1 .
– The trace arrow tr(c) is the largest lax morphism from c to Jα−1 . That is, forany f : X → A in K(T ),
Ff

f

FA
∼
= Jα−1Af
implies

X



FX
c
X

A .

tr(c)

– Dually, the trace semantics tr(c) is the smallest oplax morphisms from c toJα−1 . That is, for any f : X → A in K(T ),
Ff

f

FA
∼
= Jα−1A

tr(c)implies

X



FX
c
X

A .

f

Proof. Although the claim follows from a general result [32, Proposition 6.7], in thisspeciﬁc setting of a Kleisli category we can give another proof. Our proof depends
only on the local monotonicity of F and not on its local continuity. It avoids the useof local continuity in a similar way to the proof of Theorem 2.3.3, namely by looking
into the ﬁnal sequence for the functor F .
!

F!

Let us consider the ﬁnal sequence 1 ← F 1 ← · · · for F in K(T ).4 The following
facts are standard about the ﬁnal sequence; they are in the proof of Proposition A.1.2.
– A ﬁnal F -coalgebra (which by the way coincides with an F -initial algebra in
Sets, Theorem 2.3.3) is an ω-limit of this ﬁnal sequence. We denote this limitby (ζn : A → F n 1)n<ω .
– An F -coalgebra c : X → F X yields a cone (γn : X → F n 1)n<ω over the ﬁnal
sequence, in an inductive manner.
4 For simplicity of presentation, we employ diﬀerent notations from those in the proof of Theorem 2.3.3. For example, a ﬁnal object 1 in K(T ) is given by the empty set, so it was denoted by 0
before.

78

3 Generic forward and backward simulations– The unique coalgebra morphism tr(c) from c to the ﬁnal coalgebra coincides
with the unique mediating arrow X → A from the cone (γn ) to the limit (ζn ).

Hence we have the following situation in K(T ).
ζn
···

F n!

F n1

A (limit)

ζn+1
···

F n+1 1
γn

tr(c)

γn+1
X

In the proof of Theorem 2.3.3, it was crucial that the limit (ζn ) can be also characterized by the order-theoretical notion of O-limit (Deﬁnition A.2.3). In particular we
can take the corresponding
embedding ζnE : F n 1 → A of each ζn : A → F n 1; moreover%E
we have idA = n<ω (ζn ◦ ζn ).
Now we prove the ﬁrst statement of the proposition.
%%E
by idA = n<ω (ζnE ◦ ζn )tr(c) =n<ω ζn ◦ ζn ◦ tr(c)%E=composition is continuousn<ω ζn ◦ ζn ◦ tr(c)%E
tr(c) is a mediating arrow=n<ω ζn ◦ γn%Eζn ◦ f  γn for each n, (†)
n<ω ζn ◦ ζn ◦ f

%
E
=f ,
composition is continuous=n<ω ζn ◦ ζn ◦ fwhere the inequality (†) is proved by induction on n, using the assumption that f isa lax morphism. In this proof, local monotonicity of F has been implicitly used inshowing that the limit (ζn ) is also an O-limit.
The dual statement is proved in a similar way.


3.3.2

Soundness of forward/backward simulations
s

c

t

d

3.3.2 Theorem (Soundness of simulations). Let 1 → X → F X and 1 → Y → F Y be
(T, F )-systems. Existence of a forward/backward/backward-forward simulation from(s, c) to (t, d) implies trace inclusion tr(s, c)  tr(t, d). That is,1.
(s, c) F (t, d)2.
(s, c) B (t, d)
3. (s, c) BF (t, d)=⇒ tr(s, c)  tr(t, d) ,=⇒ tr(s, c)  tr(t, d) ,=⇒ tr(s, c)  tr(t, d) .

Proof. 1. By deﬁnition of F we have a forward simulation f : Y → X. In particular
we have the following situation in K(T ).
F (tr(c))

Ff
FY
d
Y

f

FX
c
X

=
tr(c)

FA
∼
= Jα−1 (ﬁnal)
A3.3Soundness and completeness theorems

79

The square on the right is a coinduction diagram. This shows that the arrow tr(c) ◦ f
is a lax coalgebra morphism from d to the ﬁnal coalgebra, that is,Jα−1 ◦ tr(c) ◦ f  F tr(c) ◦ f ◦ din K(T ).
Since the trace map is the biggest lax coalgebra morphism (Proposition 3.3.1), we
have tr(c) ◦ f  tr(d). This inequality is combined with f ’s condition on start statemaps.
tr(s, c) = tr(c) ◦ s  tr(c) ◦ f ◦ t  tr(d) ◦ t = tr(t, d)This proves 1. Similar arguments prove 2.
3. The relation BF is a relational composition F ◦B . We use 1. and 2. of thetheorem, and transitivity of the order  between arrows 1 ⇒ A.


3.3.3

Completeness of hybrid simulations

Completeness (the converse of soundness) does not hold for F , B but does hold forthe more strict notion of BF . For a restricted class of non-deterministic systems thecompleteness result is shown in [77, 94].
3.3.3 Theorem (Completeness of BF ).
tr(s, c)  tr(t, d)=⇒(s, c) BF (t, d) .

Proof. Given a (T, F )-system (s, c), we construct the following system which we referto as a canonical system.
tr(s, c)

1

A

Jα−1
∼
=

FA

in K(T )Its dynamics is a ﬁnal F -coalgebra; its start states map is given by the trace semanticsof the system (s, c) in consideration.
By deﬁnition of trace semantics, the arrow tr(c) : X → A is a morphism of
systems from (s, c) to this canonical system. This establishes the left side of the
diagram (3.14) below. We apply the same construction to (t, d) and obtain the rightside of the diagram. Now the assumption tr(s, c)  tr(t, d) ﬁts in the lower middle ofthe diagram.

Xs

F (tr(d))
FA∼= Jα−1
tr(c)
tr(d)
A
tr(s, c)  tr(t, d)

1

1

FX
c

F (tr(c))

FYd(3.14)

Yt1

80

3 Generic forward and backward simulations

From this we obtain the following two diagrams of backward-forward simulations—likethe diagram (3.9) in Deﬁnition 3.2.14—depending on our choice of the intermediate
system.
FX
c
X
s
1

FA
∼
=
A
tr(s, c)
1



FY
d
Y
t
1

FX
c
X
s
1

FA
∼
=
A


tr(t, d)
1

FY
d
Y
t
1

Either diagram shows (s, c) BF (t, d).

3.3.4



Similarity relations are preorders

We shall show that three similarity relations F , B and BF —corresponding toforward, backward, and backward-forward simulations, respectively—are indeed preorders. Being a preorder is a basic property that we would expect from such a relation.
The proofs have been postponed until now, because in showing transitivity of BF
we use completeness (Theorem 3.3.3).
For F and B the proof is straightforward.
3.3.4 Proposition (F , B are preorders). The forward and backward similarity
relations F and B are preorders. That is, they are reﬂexive and transitive.
Proof. Reﬂexivity is obvious: take the identity arrow in the Kleisli category as aforward (or backward) simulation. To show transitivity, assume (s, c) F (t, d) F(r, b). There exist forward simulations f and g such that

FU
b
U
r
1

Ff
f

FY
d
Y
t
1

Fg
g

FX
c
,
X
s
1

hence

FU
b
U
r
1

F (g ◦ f )
g◦f

FX
c
.
X
s
1

This shows (s, c) F (r, b). Transitivity of B is proved in a similar way.



3.3.5 Proposition (BF is a preorder). The backward-forward similarity relation
BF is a preorder.
Proof. Reﬂexivity is trivial by taking the system itself as an intermediate one. Assume(s, c) BF (t, d) BF (r, b). By soundness of BF (Theorem 3.3.2) we have tr(s, c) tr(t, d)  tr(r, b); transitivity of  implies tr(s, c)  tr(r, b). This in turn yields(s, c) BF (r, b) by completeness of BF (Theorem 3.3.3). Hence we have showntransitivity of BF .

3.4

3.4

Related work

3.4.1

Simulations in coalgebra

Related work

81

Hughes and Jacobs [58, 64] also study simulations in a coalgebraic setting. Their coalgebraic modeling of simulations—and their motivation which leads to the modeling—is quite diﬀerent from ours. They introduce their notion of simulations (which, by theway, work “forwards”) as a relaxed version of bisimulations. Based on this deﬁnition
they proceed to observe how these simulations are related to coalgebraic bisimulations,hence to ﬁnal coalgebras in Sets. This marks a contrast between their investigationand ours; in the current work simulations are related to trace semantics (not to bisimulations), hence to ﬁnal coalgebras in K(T ).
More speciﬁcally, the deﬁnition of coalgebraic bisimulations which is used in [58,64]—and which is relaxed to yield coalgebraic simulations—is the following one, using
relation liftings. (We have used relation liftings in Lemma 2.2.4.) Given coalgebrascd

X → F X and Y → F Y in Sets, a bisimulation between them is a binary relation
R ⊆ X × Y such that
(3.15)(x, y) ∈ R =⇒c(x), d(y) ∈ RelF (R) .
The relation RelF (R) ⊆ F X × F Y is the F -relation lifting of R. For illustration, let
us take F = Pﬁn (Σ × ) for which coalgebras are (ﬁnitely branching) LTSs. For thisF , the relation lifting RelF (R) is the following relation.
Pﬁn (Σ × X) × Pﬁn (Σ × Y ) , (a, x ) ∈ u =⇒ ∃y  ∈ Y. (a, y  ) ∈ v ∧ (x , y  ) ∈ R (u, v) ∈ RelF (R) ⇐⇒(a, y  ) ∈ v =⇒ ∃x ∈ X. (a, x ) ∈ u ∧ (x , y  ) ∈ R
RelF (R)⊆In this case it is obvious that a coalgebraic bisimulation (3.15) is the same thing asa conventional bisimulation between LTSs. More generally, bisimilarity deﬁned interms of these coalgebraic bisimulations (using relation liftings) coincides with thebisimilarity via coinduction (which we discussed in Section 1.3.2), if the functor F
preserves weak pullbacks.
The core assumption made in [58, 64] is that the functor F comes with a preorder
structure. Speciﬁcally, the functor F : Sets → Sets factors through the forgetful
functor PreOrd → Sets from the categories of preordered sets and monotone functions.
 PreOrd
Sets

F(3.16)Sets

In particular, each set of the form F X comes with a preorder .
This preorder structure  on F X and F Y is used to relax (3.15) and obtaincdcoalgebraic simulations in [58, 64]. Namely, a simulation from X → F X to Y → F Y

82

3 Generic forward and backward simulations

is a binary relation R ⊆ X × Y such that(x, y) ∈ R=⇒

that is,⎡⎤c(x) F X u∃u ∈ F X. ∃v ∈ F Y. ⎣ ∧ (u, v) ∈ RelF (R) ⎦ ,∧ v F Y d(y)
c(x)

F X

∃u

RelF (R)∃v

F Y(3.17)

d(y) .

Here F X refers to the preorder on F X which results from the assumption (3.16).
The condition (3.17) for simulations is weaker than (3.15) for bi simulations because,in (3.17), c(x) and d(y) can use “helper” preorders F X and F Y in order to berelated via RelF (R).
In [58, 64] it is demonstrated that the coalgebraic simulation (3.17) gives a conventional simulation in many examples. They proceed to investigate the relationshipbetween coalgebraic simulations and bisimulations, such as the following.
– When does bisimilarity coincide with two-way similarity? The former implies
the latter but not the other way round in general.
– Similarity order makes a ﬁnal coalgebra an ω-cpo. Moreover, under certain
conditions it becomes an algebraic cpo.
All these observations in [58, 64] take place in Sets.
In contrast, we take a diﬀerent view on forward/backward simulations in ourcurrent setting: simulations are tools to show trace inclusion. Hence our emphasis ison the relationship to trace semantics, in particular soundness properties. We baseour observations on a Kleisli category.
Let us compare concrete deﬁnitions of simulations obtained from the frameworkin [58, 64] and deﬁnitions obtained from ours. For non-deterministic systems, both
frameworks yield quite similar “simulations”; moreover they are similar to conventional ones such as in [94]. Indeed if we take F = P(1 + Σ × ) (equipped with
the inclusion order) in the framework of [58, 64], their notion of simulations coincides
with our forward simulations for LTSs with explicit termination (described in Example 3.2.12). Notice that in the former framework there is no distinction between
branching types and transition types; hence both P and 1 + Σ × are put into asingle functor F .
However a diﬀerence emerges in a probabilistic setting. It is possible to apply theframework of [58, 64] to a functor F which contains probabilistic branching; however,still in this case, the induced simulation is a binary relation between state spaces(see (3.17)). In contrast our simulation is a function of type X → DY . The latterﬁnds its use in showing trace inclusion (see Chapter 4); comparative merits of theformer notion of simulations is yet to be investigated.

3.4.2

Lax categorical structures and data refinement

Categorical notions of lax and oplax morphisms of coalgebras play central roles in ourframework. As we have brieﬂy mentioned, lax/oplax categorical constructs are also

3.4

Related work83

used in formalizing data reﬁnement [56, 76]. In this context of data reﬁnement, people use terminologies such as upward simulations, downward simulations, and so on.
These “simulations” are not the same things as the simulations between state-based
systems (investigated in this chapter); nevertheless we shall brieﬂy sketch “simulations” in data reﬁnement.
In short, an upward simulation in data reﬁnement is a “relationship” between two
interpretations of the same programming language. It is categorically formalized asa lax natural transformation ρ in the following situation [56].

Cl

F
⇓ρ

Dom

(3.18)G
Let us explain the situation. First, one identiﬁes the programming language of
our interest with its classifying, syntactic category Cl.
– An object in Cl is a type, such as stack;– an arrow in Cl is a piece of code which denotes a function with corresponding
types, such as pop : stack → stack, or (pop; pop) : stack → stack.
These syntactic objects are interpreted in a locally-ordered category Dom of “semantic domains” such as Dom = Cppo. An interpretation is given categorically as afunctor F : Cl → Dom; it carries objects (i.e. types) and arrows (i.e. functions) in
Cl to their interpretations in Dom, respectively.
The basic idea of data reﬁnement is as follows. Given two interpretations F and
G of the programming language Cl in Dom, sometimes one would like to say ‘F is areﬁned interpretation of G’ or ‘F gives a representation of a “speciﬁcation” G.’ Sucha statement would mean that there is, for each type X ∈ Cl, an arrow
ρX : F X −→ GX

in Dom.

Moreover this “translation” should be compatible with interpretations of functions:ffor each arrow X → Y in Cl,
FX
Ff
FY

ρX

ρY

GX
Gf
GY

(3.19).

This makes ρ : F ⇒ G a natural transformation.
However, in a “speciﬁcation” G, some function f may be yet to be interpreted.
Categorically it means that the arrow Gf : GX → GY in Dom might be the bottom ⊥(which is available e.g. when Dom is Cppo). Nevertheless the reﬁned interpretation
F may have the function f already interpreted; in this case the diagram (3.19) does

84

3 Generic forward and backward simulations

not commute but rather one obtains an inequality in the square.
FX
Ff
FY

ρX

ρY

GX
Gf
GY

.

Hence an upward simulation ρ from F to G—which witnesses that F is a reﬁned
interpretation of G—is a lax natural transformation as in the situation (3.18). Herethe order structure of Dom is considered to be “degree of deﬁnedness” [76].

3.4.3(Bi)simulations for probabilistic systems

We have obtained the notion of “probabilistic forward/backward simulations” by suitably instantiating our coalgebraic simulations (Example 3.2.13). What is notable
about it is that a simulation is not a binary relation between state spaces, but insteada function of the type X → DY ; and that we have soundness theorems for free.
There have been deﬁnitions of “bisimulations” and “simulations” for probabilistic
systems, proposed by several authors. Here we shall focus on two notable deﬁnitions among them—those introduced in [88, 120]—and compare these two with ourdeﬁnition.
In [120] the notion of (forward) simulations is introduced for (Segala’s) probabilistic
automata which are models of probabilistic systems introduced in [120]. It is proved tobe sound with respect to trace inclusion in [120]. Moreover in [95] these simulations areshown to be also complete, with respect to trace distribution precongruence ≤DC —it is the coarsest preorder which is included in the trace inclusion preorder and is“compositional,” i.e. compatible with parallel composition of probabilistic automata.
The biggest diﬀerence between the setting of [95, 120] and ours is that (Segala’s)probabilistic automata have both non-deterministic and probabilistic branching. Coalgebraically, (Segala’s) probabilistic automata are functions of the type
X −→ PDF X
where F is a suitable transition type. See [128] for detailed treatment of coalgebraic
formulation of various models of probabilistic systems. Our coalgebraic theory of
traces and simulations (in K(T )) has not been applied to this combined branchingyet (see Section 2.6).
Still the following fact suggests possible applicability of our coalgebraic framework.
A “simulation” in [120] is not a binary relation between states, but it is a relation
between a state and a probability distribution over states, which can be identiﬁed
with a function of the type X → PDY .
R ⊆ X × DY,
X −→ PDY

a relationin Sets3.4

Related work

85

Hence this simulation might be an arrow X → Y in a suitable Kleisli category likeK(PD);5 if so, it matches our framework where a simulation is an arrow X → Y inK(T ).
Another point to note is that the notion of “trace inclusion” in [95, 120] between(Segala’s) probabilistic automata is quite diﬀerent from ours. Speciﬁcally, trace semantics for a (Segala’s) probabilistic automaton is given by a set of probabilistic
distributions over the set of linear-time behavior, that is, a function
tr(s, c) : 1 −→ PDA
where A is the set of all linear-time behavior. Now the “trace inclusion” ordertr(s, c)  tr(t, d) is deﬁned by:tr(s, c)  tr(t, d)⇐⇒∀d ∈ tr(s, c). d ∈ tr(t, d) .

Hence “trace inclusion” for (Segala’s) probabilistic automata in [95, 120] refers to(pure) set inclusion; it does not say anything about the comparative quantity ofprobability with which a linear-time behavior would occur. In contrast, in our setting(which is purely probabilistic), trace inclusion—deﬁned in terms of the Cppo-enriched
structure of K(D)—is based on comparative quantity of probability.
The other deﬁnition that interests us is the notion of probabilistic bisimulationin [88]. A probabilistic bisimulation in [88] is deﬁned between purely probabilistic
systems (i.e. no non-deterministic branching) so the setting is similar to ours; still
it is given by a binary relation, in contrast to ours which are functions of the type
X → DY . Roughly speaking, an equivalence relation R ⊆ X × X on a state space ofa probabilistic LTS is said to be a probabilistic bisimulation if
xRy=⇒∀a ∈ Σ. ∀S ∈ X/R.

aa

Pr(x → S) = Pr(y → S) .

(3.20)aHere Σ is the set of actions and Pr(x → S) is the probability with which x makes ana-move to one of the states in S. That is,aPr(x → S) ="Pr(x → x ) .
a

x ∈S

The problem is that this deﬁnition is not immediately transformable into a deﬁnitionof simulations. Speciﬁcally, the relation R’s being an equivalence is crucial in writing
down the condition (3.20); however we expect a simulation to be a preorder rather
than an equivalence. Additionally, the above deﬁnition of probabilistic bisimulations
works only within the same system. It does not easily generalize to bisimulations
between two diﬀerent systems; neither to simulations from one system to another.
5 It is known that the combination PD is not a monad [136]. To make it a monad a small
modiﬁcation is needed for either P or D.

86

3 Generic forward and backward simulations

3.5

Summary and future work

Continuing from Chapter 2, we have developed a generic theory of traces and simulations in terms of coalgebras in Kleisli categories. Notions such as forward/backward
simulations and traces are deﬁned and related via soundness and completeness results.
Several illustrating examples suggest implications of this theory in practice.
As mentioned in Section 2.6, systems with both non-deterministic and probabilistic branching (such as Segala’s probabilistic automata) do not ﬁt in our generalframework. Some observations regarding the potential applicability of our framework
have been made in Section 3.4.3.
Later in Chapter 5 we will introduce a generic coalgebraic framework to describe
parallel composition of systems and compositionality of process semantics. As mentioned in Section 2.6, the framework works for all the process semantics given bycoinduction, hence including trace semantics (by coinduction in K(T )). The relationship between this composition framework and the material in this chapter (onsimulations) is investigated as well; we will obtain compositionality results for similarity relations F , B and BF (Propositions 5.5.5 and 5.5.6).
Often a process equivalence ∼ (or a process preorder ) is characterized by meansof some modal logic: C ∼ D (or C  D) if, for any formula ϕ in the logic,
C |= ϕ⇐⇒D |= ϕ(or

C |= ϕ=⇒D |= ϕ),respectively. A classic result of this kind is expressivity of the Hennessy-Milner
logic with respect to bisimilarity [52]; other than that a variety of process equivalences/preorders have been given such characterizations (see e.g. [39]). The canonicaltesting situation in Section 2.5 is also considered to be a “logical characterization”
of coalgebraic trace equivalence (Proposition 2.5.9); logical characterizations of thecoalgebraic similarity relations F and B in this chapter is yet to be investigated.
IOA Toolset [38] is a formal veriﬁcation tool in which systems are described as I/O
automata and analyzed using simulations. Now that its base theory is made generic,one might as well contemplate on a generic version of the toolset as well.

Chapter 4
Case study: probabilistic anonymity

There is a growing concern about anonymity and privacy on the Internet, resulting
in lots of work on formalization and veriﬁcation of anonymity. Especially, importanceof probabilistic aspects of anonymity is claimed recently by many authors. Several
diﬀerent notions of “probabilistic anonymity” have been studied so far, but proof
methods for such probabilistic notions are not yet much elaborated. In this chapter we
introduce a simulation-based proof method for one notion of probabilistic anonymity
introduced by Bhargava and Palamidessi [15], called strong probabilistic anonymity.
The method is a probabilistic adaptation of the one by Kawabe, Sakurada et al. fornon-deterministic anonymity [71, 72]: anonymity of a protocol is proved by ﬁndingout a forward/backward simulation between certain automata. For the jump from
non-determinism to probability we exploit the generic, coalgebraic theory of traces
and simulations developed in Chapters 2 and 3. In particular, an appropriate notionof probabilistic simulations is obtained as an instantiation of the generic deﬁnition,
for which a soundness theorem comes for free. Additionally, we show how we canuse a similar idea to verify a weaker notion of probabilistic anonymity called probableinnocence.

4.1

Overview

4.1.1

Online anonymity

Nowadays most human activities rely on communication over the Internet, hence oncommunication protocols. This has made veriﬁcation of communication protocols
a trend in computer science. At the same time, varying purposes of communication protocols have identiﬁed new veriﬁcation goals—or security properties—such as
anonymity, in addition to rather traditional ones like secrecy and authentication.
Anonymity properties have attracted growing concern from the public. Thereare emerging threats as well: for example, the European Parliament in December87

88

4 Case study: probabilistic anonymity

2005 approved rules forcing ISPs to retain access records. Consequently an increasing
extent of research activities—especially from the formal methods community—are
aiming at veriﬁcation of anonymity properties (see [6]).
Formal veriﬁcation of anonymity properties is relatively young compared to authentication or secrecy. The topic still allows for deﬁnitional work (such as [15, 22,
37, 41, 57, 110]) pointing out many diﬀerent aspects of anonymity notions. Notably
many authors [15, 22, 41, 123, 124] claim the signiﬁcant role of probability in anonymity
notions. This is the focus of the current work.

4.1.2

Probabilistic anonymity

There have been several diﬀerent notions of anonymity proposed in probabilistic settings, e.g. [15, 41, 112]. There are also some case studies which analyze existinganonymizing protocols and examine whether they satisfy the notions of probabilistic
anonymity. However, generic veriﬁcation methods for probabilistic anonymity have
not yet much elaborated.
In this chapter we introduce simulation-based proof methods for two diﬀerent notions of probabilistic anonymity. The ﬁrst one is strong probabilistic anonymity (which
will be also called strong anonymity) introduced by Bhargava and Palamidessi [15].
The deﬁnition requires that, by observing an execution of the protocol, the adversary
should gain absolutely no information on who is the person to be blamed—the culprit. The notion is a natural probabilistic adaptation of the non-deterministic notionof trace anonymity.1
What we shall do in this chapter is to adapt a proof method as well, from the onefor (non-deterministic) trace anonymity to the one for probabilistic strong anonymity.
The proof method we start with is the simulation-based one which is introducedin [71, 72]. Its basic scenario is as follows.
1. First we model an anonymizing protocol as a certain kind of automaton X .
2. Second we construct the anonymized version an(X ) of X . The automatonan(X ) satisﬁes the appropriate notion of anonymity because of the way it isconstructed.
3. We prove that(trace semantics of X ) = (trace semantics of an(X )) .
Then, since the notion of anonymity is deﬁned in terms of traces, anonymityof an(X ) yields anonymity of X . The equality is proved by showing that the(appropriate notion of) inclusion order  holds in both directions.
– One direction  holds because of the construction of an(X ).
1 The notion of trace anonymity is originally introduced in [119] under the name of strong
anonymity. In this chapter we follow [71, 72] and call it trace anonymity. This is for the sakeof terminological convenience.

4.1

Overview

89– The other direction
is proved by ﬁnding a (forward or backward) simulation from an(X ) to X . Here we appeal to the soundness theorem forsimulations—existence of a simulation implies trace inclusion.
Hence the anonymity proof of X is reduced to ﬁnding a suitable forward/backward
simulation.

4.1.3

Converting non-determinism to probability

The basic scenario remains the same for strong (probabilistic) anonymity. However,there is an obvious diﬃculty in conducting the scenario in a probabilistic setting.
The theory of traces and simulations in a non-deterministic setting is well studied
e.g. in [94]; however appropriate deﬁnitions of probabilistic traces and simulations arefar from trivial.
This jump from non-determinism to probability is where we exploit the generic,coalgebraic theory of traces and simulations developed in the previous chapters. In
the generic theory, fundamental notions such as systems (or automata), trace semantics and forward/backward simulations are identiﬁed as certain kinds of coalgebraic
constructs. On this level of abstraction the general soundness theorem—existence of a(coalgebraic) simulation yields (coalgebraic) trace inclusion—is proved by categoricalarguments.
The generic theory has two parameters T and F appearing in it; by making diﬀerent choices of these parameters the theory can cover a wide variety of systems. In particular, according to the choice of one parameter T , systems can be non-deterministic
or probabilistic. In this chapter we obtain a complex deﬁnition of probabilistic simulations as an instance of the general, coalgebraic deﬁnition. Moreover, this deﬁnition isa useful one: a soundness theorem comes for free from the general soundness theorem.
After a simulation-based proof method for strong (probabilistic) anonymity, we
use a similar idea to verify a weaker anonymity notion called probable innocence. The
notion appears in [41, 112] and is extensively studied in [23]. The signiﬁcance of
this weaker notion is due to the fact that many real-world anonymizing protocols—
which include Crowds [112]—do not satisfy strong anonymity but do satisfy probableinnocence. Intuitively, probable innocence does allow the adversary to learn some
information about the culprit; but it requires that this information leak is only up toa certain bound.
We take the deﬁnition in [23]—which generalizes the ones in [41, 112]—and present
a simulation-based proof method for this notion. Although the basic scenario is notexactly the same as before, the idea of using simulations is quite similar.

4.1.4

Outline of the chapter

In Section 4.2 we illustrate notions of probabilistic anonymity using a couple of examples. They include the Dining Cryptographers protocol and the Crowds protocol.
The formal deﬁnitions of anonymity notions are presented in 4.3, where we also introduce our models of anonymizing protocols called anonymity automata. In Section 4.4

90

4 Case study: probabilistic anonymity

we describe our simulation-based proof method for strong anonymity and prove its
correctness. In Section 4.5 the proof method for probable innocence is described.
Relation to other work with a similar interest is discussed in Section 4.6.
Notations The set of lists in an alphabet X with length ≥ 1 is denoted by X + ,that is, X + = X ∗ · X in a regular-expression-like notation. This appears later as adomain of trace semantics for anonymity automata.

4.2

Motivating examples

In this section we motivate– the probabilistic aspect of anonymity, and– possible candidates for a formal notion of “probabilistic anonymity,”by presenting concrete examples of anonymizing protocols. The ﬁrst example is the
Dining Cryptographers (DC) protocol [25]: this common example in the formal studyof anonymity protocols will illustrate the important role of probability in anonymizing protocols. The second example of simple and artiﬁcial protocols for anonymous
donation will clarify the idea behind the notion of strong probabilistic anonymity. In
the last place we present an example of Crowds [112]—which does not satisfy strong
probabilistic anonymity—to motivate the weaker notion of probable innocence.

4.2.1

The Dining Cryptographers (DC) protocol

Here we follow [15] to illustrate the role of probability in anonymity, using the Dining
Cryptographers (DC) protocol.
There are three cryptographers (or “users”) dining together. The payment will bemade either by one of the cryptographers, or by NSA (U.S. National Security Agency)
which organizes the dinner. Who is paying has been determined by NSA; if one of
the cryptographers is paying, the payer has been told so beforehand.
The goal of the DC protocol is as follows. The three cryptographers– reveal whether there is a payer among them, but– not revealing which of them is the payer (if any),
to the observer (called the adversary in the sequel) and also to the cryptographers
who are not paying.
The protocol proceeds in the following way. Three cryptographers Crypti for i =0, 1, 2 sit in a circle, each with a coin Coini . The coins are held in such a way that they
can be seen by the owner and one of the other two: the arrows → in the following
ﬁgure denote the “able-to-see-her-coin” relation.
Crypt0
Crypt1

Crypt2

4.2

Motivating examples

91

Hence Crypt0 can see the coin held by Crypt1 as well as her own. Then the coins are
ﬂipped; each cryptographer, comparing the two coins she can see, announces to the
public whether they agree (showing the same side) or disagree. The trick is that theone who is paying—if there is—must lie about the announcement. For example, giventhat Crypt0 is paying, the conﬁguration of coins(h, t, h)that ishth,results in the announcement(a, d, a)that isada .

This announcement is the only thing the adversary can observe; occurrence of an odd
number of d’s reveals the presence of a liar, hence the presence of a payer among thecryptographers.
Can the adversary tell which cryptographer is paying? No. In fact, given any
announcement with an odd number of d’s, one can construct a coin conﬁguration
which yields the given announcement under an arbitrary choice of the payer. For
example, the announcement (a, d, a) above can be obtained from any of the following
conﬁgurations.
Crypt0 pays, and coins are (h, t, h) or (t, h, t)
Crypt1 pays, and coins are (h, h, h) or (t, t, t)
Crypt2 pays, and coins are (h, h, t) or (t, t, h)

4.2.2

Probabilistic anonymity in DC

Up to now our arguments have been non-deterministic; now we shall explain how
probabilistic aspects in DC can emerge. Assume that the coins are biased: each of
three Coini ’s gives head with the probability 9/10. Provided that Crypt0 is paying, theannouncement (a, d, a) occurs with the probability (9 · 1 · 9 + 1 · 9 · 1)/103 , because it
results from (h, t, h) or (t, h, t). Similar calculations lead to the following table ofconditional probabilities.
Crypt0 pays
Crypt1 pays
Crypt2 pays

(d, a, a)
0.73
0.09
0.09

(a, d, a)
0.09
0.73
0.09

(a, a, d)
0.09
0.09
0.73

(d, d, d)
0.09
0.09
0.09

Are the cryptographers still “anonymous”? We would not say so. For example, if
the adversary observes an announcement (d, a, a), it is reasonable for her to suspect
Crypt0 more than the other two.
Nevertheless, if the coins are not biased we cannot ﬁnd any symptom of broken
anonymity. Therefore we want to come up with the following two things.

92

4 Case study: probabilistic anonymity

The ﬁrst is an appropriate notion of “probabilistic anonymity” which holds withfair coins but is violated with biased coins. This is done in [15] and the deﬁnition will
be explained using the next simpler example.
The second is an eﬀective proof method to verify this notion of anonymity. This
is what we aim at in the current work.

4.2.3

Strong probabilistic anonymity

In this section we present toy examples of probabilistic anonymizing protocols tomotivate the notion of strong (probabilistic) anonymity [15].
Let us think of a situation of anonymous donation: one of two cryptographers
Crypt0 and Crypt1 tries to donate some money, without revealing the donor’s identity.
Consider the following three protocols, X0 , X1 , X2 from left to right.
9$5[ 10]9$5[ 10]

Crypt0 [ 12 ]1
$10K[ 10]9$5[ 10]Crypt1 [ 12 ]1
$10K[ 10]

Crypt0 [ 13 ]1
$10K[ 10]9$5[ 10]

Crypt1 [ 23 ]1
$10K[ 10]1
$5[ 10]Crypt0 [ 13 ]9
$10K[ 10]9$5[ 10]

Crypt1 [ 23 ]



1
$10K[ 10
]







It is assumed that the labels Crypti —deciding which cryptographer is the donor—
are invisible for the observer. Only the labels $n—for money transactions—are visible.
The ﬁrst protocol X0 works as follows. First the donor is chosen with the uniform
probability distribution; no matter which is chosen, the donor donates $5 with theprobability 9/10 and $10K with 1/10. In the second protocol X1 , it is in the speciﬁcation of the protocol (hence is known to the adversary) that Crypt1 is more likely tobe the donor—the culprit. In X2 (in comparison to X1 ), Crypt0 is known, so to say, tobe rich: when she is chosen as the donor more often than not she gives away $10K.
Are these protocols “anonymous”? That is, by observing money transactions,
can the adversary tell who is the culprit? Intuitively it is clear that X0 should be“anonymous” and X2 should not be. X1 can be debatable but we want to claim it
to be anonymous. It is true that Crypt1 is inherently more suspicious than Crypt0 in
X1 (the a-priori distribution of suspicion is not uniform). However, after observing
any execution of the protocol, from the adversary’s viewpoint the cryptographers lookexactly as suspicious as before. In other words, in X1 , an observation of transactionof $5 or $10K does not carry any information on who is the culprit.
This intuition leads to the notion of strong anonymity introduced in [15]. Here we
give an informal description; a formal deﬁnition is found in Deﬁnition 4.3.8.
4.2.1 Deﬁnition (Strong anonymity). An anonymizing protocol X satisﬁes strong(probabilistic) anonymity if, for any observation o and users i and j, we have
PX (o | i is a culprit) = PX (o | j is a culprit) .

4.2

Motivating examples

93

Here PX (o | i is a culprit) denotes the conditional probability for the event “giventhat the user i is the culprit, an execution of X yields the observation o.”
The intuition behind this deﬁnition is quite similar to the one behind the notion of
conditional anonymity [41] whose formal deﬁnition is given later in Deﬁnition 4.3.9.
In fact, it is shown in [15] that under reasonable assumptions these two notions ofanonymity coincide.

4.2.4

Crowds and probable innocence

Although the DC protocol with fair coins (as well as the anonymous donation protocols X0 and X1 in Section 4.2.3) satisﬁes strong anonymity, there are a large body ofreal-world protocols which do not satisfy the property. Crowds [112] is one of them.
The Crowds protocol aims at anonymous web browsing, so that a user can send arequest to a web server without revealing the user’s identity. In essence the identity
is concealed by relaying the request among a set (“crowd”) of relays.

– A user, who has already joined a group (“crowd”) of hosts, picks one relay outof the crowd with a uniform probability and forwards a request to the chosen
relay. The relay can be the initiating user herself.
– A relay in a crowd, on receiving a request, ﬂips a (biased) coin to decide whether• to deliver the request to its intended recipient, i.e. the web server (thishappens with the probability 1 − pf ), or• to forward it to another relay (with the probability pf ). The next relay is
chosen from the crowd with the uniform probability, including the current
relay itself.
Here the probability pf is a system-wide parameter. This way the web server only
sees a request coming from a relay, hence it is not sure who initiated the request.
It is obvious that Crowds gives no anonymity guarantee against a global eavesdropper —an adversary capable of observing all the network traﬃc—because a global
eavesdropper can see the initiator sending out a message without receiving any message beforehand. A more realistic attack scenario is that some of the relays are corrupt

94

4 Case study: probabilistic anonymity

and they cooperate with the adversary. A short calculation shows the following. The
fact that a certain host i has sent a request to a corrupt relay—although the adversary
cannot tell for sure whether the host i is the initiator of the request or is just forwarding it—makes the host i probabilistically more suspicious than the other hosts.
This makes the strong anonymity fail: the observation “i has sent a request to me”
does carry some information on who is the initiator.2
Still, when the number of relays (i.e. the cardinality of the crowd) is suﬃciently
bigger than that of corrupt relays, we want to say that Crowds is “anonymous,” that
is, Crowds satisﬁes some weaker notion of anonymity that allows information leak up
to a certain amount. The notion of probable innocence is one candidate of such an
anonymity notion.
Intuitively, probable innocence is satisﬁed if after any observation, the adversary
can never have conﬁdence exceeding 1/2 that someone is the culprit. In [112] it isshown that Crowds satisﬁes probable innocence if pf > 1/2 and the number n ofpf
(c + 1).3
relays and the number c of corrupt relays satisfy the inequality n ≥ pf −1/2
However, the above statement in [112] is only true if every user in the crowd isequally suspicious a-priori, i.e. before an execution of Crowds. Assume there is auser who is known to be much more frequently an initiator of a request than otherusers; then the above “conﬁdence is ≤ 1/2” deﬁnition of probable innocence is moreeasily violated. The situation is similar to the comparison between X0 and X1 in Section 4.2.3; we want our deﬁnition robust to such a change of the a-priori distributionof suspicion. A user who is a-priori more suspicious than the others can still look
more suspicious than the others after an execution of the protocol; a bit more than it
did before an execution, because now we allow some marginal information leak; but
not much more.
This idea led Chatzikokolakis and Palamidessi [23] to the following deﬁnition ofprobable innocence, which we formally present later in Deﬁnition 4.3.10. It is also
shown to coincide with the original deﬁnitions in [41, 112] under suitable assumptions.
4.2.2 Deﬁnition (Probable innocence). An anonymizing protocol X satisﬁes probableinnocence if, for any observation o and user i we have(n − 1) 

PX (i is a culprit | o)
PX (i is a culprit)
≥
.
P
(j
is
a
culprit)j=i Xj=i PX (j is a culprit | o)

(4.1)

Here n is the number of users who can possibly be a culprit; we are assuming thattwo diﬀerent users cannot be culprits at the same time.
2 Strong anonymity is satisﬁed if no relay in the crowd is corrupt. In this case, the adversary isa web server outside the crowd; when it receives a request from a host i, it can tell for sure that i
is forwarding the request (recall that at least one forwarding is mandated). Hence the host i is no
more suspicious than the other hosts.
3 In fact, the deﬁnition of probable innocence used in [112] is slightly diﬀerent from this one which
is based on the deﬁnition in [41]. These two are shown in [23] to coincide under some mild conditions.

4.3

Formalizing notions for probabilistic anonymity

95

The left-hand side of (4.1) is about the a-priori distribution of suspicion. To get
an idea let us assume that the a-priori distribution is uniform. Then (4.1) becomes
PX (i is a culprit | o).
j=i PX (j is a culprit | o)1≥ 

If we moreover assume that the observation o reveals existence of a culprit, that is,"
PX (i is a culprit | o) = 1 ,ithe condition is equivalent to 1/2 ≥ PX (i is a culprit | o). In this way we can recover
the original deﬁnition: “the adversary’s conﬁdence does not exceed 1/2.”

4.3

Formalizing notions for probabilistic anonymity

4.3.1

Anonymity automata: models of anonymizing protocols

In this chapter anonymizing protocols are formalized as a speciﬁc kind of probabilistic
systems which we shall call (probabilistic) anonymity automata. The notion is to someextent similar to probabilistic automata [121]. However, in anonymity automata,branching is purely probabilistic without any non-determinism. This modiﬁcation,
together with other minor ones, is made so that the coalgebraic framework of theprevious chapters applies.
The features of an anonymity automaton are as follows.
– By making a transition it can eithera• execute an action and successfully terminate (x → ), ora• execute an action and move to another state (x → y).
For technical simplicity we leave out internal actions (denoted by τ ).
– An action a can be either• an observable action o which can be seen by the adversary, or• an actor action act(i) which means the choice of a user i as the culprit.
– Each state comes with a probability subdistribution over the set of possible
transitions. Recall that, by “sub”distribution it is meant that the sum of all the
probabilities is ≤ 1 rather than = 1. The missing probability is understood as
the probability for deadlock.
Here is a formal deﬁnition.
4.3.1 Deﬁnition (Anonymity automata). An anonymity automaton is a 5-tuple(X, U, O, c, s) where:

96

4 Case study: probabilistic anonymity– X is a non-empty set called the state space.
– U is a non-empty set of users.4– O is a non-empty set of observable actions.
– c : X → D A × {} + A × X is a function which assigns to each state x ∈ X aprobability subdistribution c(x) over possible transitions. The set A is the setof actions and deﬁned by
A = O + { act(i) | i ∈ U } .
The operation D is the subdistribution monad; its action on a set Y is given by"
d(y) ≤ 1 .
(4.2)
DY = d : Y → [0, 1] |y∈YFor example, the value c(x)(a, )5 in [0, 1] is the probability with which a stateax executes a and then successfully terminate (i.e. x → ).
– s ∈ DX is a probability subdistribution over the state space X. This speciﬁes
which state would be a starting (or initial ) one.
A major diﬀerence between (probabilistic) anonymity automata and probabilistic LTS
with explicit termination (Example 3.2.3) is that the former executes an action evenawhen it terminates (x → ); while the latter does not (x → ).
4.3.2 Example (Anonymity automaton XDC for DC). To model the DC protocol,
we take
U = {0, 1, 2} ,O = {a, d} × {a, d} × {a, d} = (x, y, z) | x, y, z ∈ {a, d} .
We need to ﬁx the a-priori probability distribution on who will make a payment. Let
us denote by pi the probability with which the user i pays.
The following is a natural representation of the DC protocol (with its a-priori
probability distribution given by pi ’s). It makes explicit use of internal actions which
we still have to get rid of. Probability for each transition is presented in square
brackets; otherwise the transition occurs with probability 1.
↓
act(0) [p0 ]h0 [ 12 ]t0 [ 12 ]h1 [ 12 ]h2 [ 12 ]t1 [ 12 ]t2 [ 12 ]h2 [ 12 ]h2 [ 12 ]τ [1 − p0 − p1 − p2 ]h0 [ 12 ]t0 [ 12 ]

(a, a, a)t2 [ 12 ](a, d, d)(d, d, a)t1 [ 12 ]t2 [ 12 ]h2 [ 12 ](d, a, d)(d, a, d)´h1 [ 12 ]h2 [ 12 ]t2 [ 12 ](d, d, a)`(a, d, d)

4 A user is called an anonymous user in [15].

t1 [ 12 ]t2 [ 12 ]h2 [ 12 ](a, a, a)(d, a, a).. act(2) [p2 ].

h1 [ 12 ]t2 [ 12 ](d, d, d)(a, d, a)t1 [ 12 ]t2 [ 12 ]h2 [ 12 ](a, a, d)(a, a, d)h1 [ 12 ]h2 [ 12 ]t2 [ 12 ](a, d, a)(d, d, d)(d, a, a)act(1) [p1 ] .
..

5 To be precise this should be written as c(x) κ (a, ) , where κ : A × {} → A × {} + A × X
1
1

is the inclusion map.

4.3

Formalizing notions for probabilistic anonymity

97

Here τ denotes an internal action with the intention of “NSA pays.”
However, the coin-ﬂip actions hi and ti —with their obvious meanings—must not
be present because they are not observable by the adversary nor are actor actions.
These actions are replaced by τ ’s. Moreover, for technical simplicity we do not allow
τ ’s to appear in an anonymity automaton. Hence we take the “closure” of the above
automaton in an obvious way, and obtain the following.

1 −p2(a, a, a)[ 1−p0 −p
]
4

↓

1 −p2
(a, d, d)[ 1−p0 −p]4xact(0) [p0 ]

act(1) [p1 ]

y0

y1









(d, d, d)[ 41 ]

(a, a, d)[ 41 ]

(a, d, a)[ 41 ]

(d, a, a)[ 41 ]

(d, d, d)[ 41 ]



1 −p2
(d, d, a)[ 1−p0 −p]4y2(a, a, d)[ 41 ]

(a, d, a)[ 41 ]

(d, a, a)[ 41 ](d, d, d)[ 41 ](a, a, d)[ 41 ](a, d, a)[ 41 ](d, a, a)[ 41 ]


1 −p2(d, a, d)[ 1−p0 −p]4

act(2) [p2 ]







The start state distribution s is: x → 1. This anonymity automaton we shall refer to
as XDC .

4.3.2

Anonymity automata reconciled as coalgebras

The generic, coalgebraic theory of traces and simulations (Chapters 2 and 3) applies toanonymity automata. Recall that the generic theory is developed with two parameters
T and F :– a monad T on Sets speciﬁes the branching type, such as non-determinism orprobability;– a functor F on Sets speciﬁes the transition type, i.e., what a system can do bymaking a transition.
Systems for which traces/simulations are deﬁned are called (T, F )-systems in thegeneric theory, making the parameters explicit (Deﬁnition 3.2.1). The theory is coalgebraic because a (T, F )-system is essentially a coalgebra in a Kleisli category K(T ).
Anonymity automata ﬁt in this generic framework. They are (T, F )-systems withthe following choice of parameters T and F .
– T is the subdistribution monad D, modeling purely probabilistic branching.
– F X = A×{}+A×X, modeling the transition-type of “(action and terminate)or (action and next state).”98

4 Case study: probabilistic anonymity

It is immediately seen that for this choice of F , the set A+ (of lists in A with length≥ 1) carries the following initial algebra in Sets. We denote its structure map by α.
A × {} + A × A+∼
α =

κ1 (a, )→κ2 (a, −
a)

A+

a

→
a·−
a

,

→
→
where a denotes a list of length 1, and a · −a is what would be written as (cons a −a)+in Lisp. Therefore Deﬁnition 2.4.1 suggests that the set A is the appropriate domainof (ﬁnite) trace semantics for anonymity automata; this is indeed the case later in
Deﬁnition 4.3.3.

4.3.3

Trace semantics for anonymity automata

Trace semantics for anonymity automata is used in deﬁning probabilistic notionsof anonymity. In a non-deterministic setting, trace semantics yields a set of lists(“traces”) of actions which can possibly occur during an execution. In contrast, trace
semantics of a probabilistic system is given by a probability subdistribution over lists.
4.3.3 Deﬁnition (Trace semantics for anonymity automata). Given an anonymity
automaton X = (X, U, O, c, s), its trace semantics
PX ∈ D(A+ )is deﬁned as follows. For a list of actions a0 , a1 , . . . , an  with a ﬁnite length n ≥ 1,
"
an−1
a
a
an
PX (a0 , a1 , . . . , an ) =PX (x0 →0 x1 →1 · · · → xn →) ,x0 ,x1 ,...,xn ∈X

where the probability
a

a

an−1

a

n
PX (x0 →0 x1 →1 · · · → xn →)= s(x0 ) · c(x0 )(a0 , x1 ) · · · · · c(xn−1 )(an−1 , xn ) · c(xn )(an , )

a

a

an−1

is for the event that an execution of X starts at x0 , follows the path →0 x1 →1 · · · →an.
xn and ﬁnally terminates with →→−→Intuitively the value PX ( a ) ∈ [0, 1] for a list −a ∈ A+ is the probability with→−which the system X executes actions in a successively and then terminates. Ourconcern is about actions (observable actions or actor actions) the system makes but
not about the (internal) states it exhibits.
The following alternative characterization allows us to apply the generic, coalgebraic theory of traces (Chapters 2 and 3).
4.3.4 Lemma (Trace semantics via the generic theory). Given an anonymity automaton X , let (s, c) be a (T, F )-system identiﬁed with X as in Section 4.3.2.
The trace semantics PX of X coincides with the coalgebraic trace semantics tr(s, c)deﬁned for (s, c) (Deﬁnition 3.2.5).
4.3

Formalizing notions for probabilistic anonymity

99

4.3.5 Example (Dining cryptographers). For the anonymity automaton XDC in
Example 4.3.2, its trace semantics PXDC is the following probability subdistribution.
 act(i), (d, a, a)  act(i), (a, d, a)  act(i), (a, a, d)  act(i), (d, d, d) → pi /4→ pi /4→ pi /4→ pi /4

 (a, a, a) 
 (a, d, d)  (d, a, d)  (d, d, a) 

→
→
→
→

(1 − p0 − p1 − p2 )/4(1 − p0 − p1 − p2 )/4(1 − p0 − p1 − p2 )/4(1 − p0 − p1 − p2 )/4(for i = 0, 1, 2)
The other lists in A+ have probability 0.
In this work we assume that in each execution of an anonymizing protocol there
appears at most one actor action. This is the same assumption as [15, Assumption 1]
and is true in all the examples in this chapter.
4.3.6 Assumption (At most one actor action). Let X = (X, U, O, c, s) be an→→
a contains more than one actor actions,anonymity automaton and −a ∈ A+ . If −→−then we have PX ( a ) = 0.

4.3.4

Notions of probabilistic anonymity

In this section we formalize two diﬀerent notions of probabilistic anonymity, namely
strong (probabilistic) anonymity [15] and probable innocence [23, 41, 112].
First, for the sake of simplicity of presentation, we shall introduce the following
notations for predicates (i.e. subsets) on A+ .
→4.3.7 Deﬁnition (Predicates [act(i)] and [−o ]).
– For each i ∈ U, a predicate [act(i)] on A+ is deﬁned as follows. In a regularexpression-like notation,[act(i)] = O∗ · act(i) · O∗ ,that is, it is the set of lists which contains only one actor action which is act(i).
Obviously we have [act(i)] ∩ [act(j)] = ∅ if i = j, by Assumption 4.3.6.
→→– For each −o ∈ O∗ , a predicate [−o ] on A+ is deﬁned as follows.
→
→
→
→
[−
o ] = {−a ∈ A+ | removeActor(−
a)=−
o} ,
where the function removeActor : A+ → O∗ —which is deﬁned by a suitable→induction—removes actor actions appearing in a list. Hence the set [−
o] ⊆
→
−
+
A consists of those lists which yield o as the adversary’s observation. It is→→emphasized that [−o ] is not the set of lists which contain −o as sublists: weremove only actor actions, but do not remove observable actions.

100

4

Case study: probabilistic anonymity

Note that we are overriding the notation [ ]: no confusion would arise since
the arguments are of diﬀerent types. Values such as PX ( [act(i)] ) are deﬁned in astraightforward manner:"→
PX ( [act(i)] ) =
PX (−
a) .
→
−
a ∈[act(i)]This is the probability with which X yields an execution in which the user i is a
culprit.
Strong (probabilistic) anonymity
Based on anonymity automata as models of anonymity protocols, we shall formalize
the notion of strong anonymity which is informally introduced in Deﬁnition 4.2.1.
4.3.8 Deﬁnition (Strong anonymity [15]). We say an anonymity automaton X sat→
isﬁes strong anonymity if, for each i, j ∈ U and −o ∈ O∗ ,PX ( [act(i)] ) > 0 ∧ PX ( [act(j)] ) > 0→→=⇒ PX ( [−o ] | [act(i)] ) = PX ( [−o ] | [act(j)] ) .
→o ] | [act(i)] ) is a conditional probability: it is given by
Here PX ( [−→o ] ∩ [act(i)] )PX ( [−→.
PX ( [−o ] | [act(i)] ) =PX ( [act(i)] )It is shown in [15] that under reasonable assumptions this notion coincides withconditional anonymity [41], whose formal deﬁnition we present now.
4.3.9 Deﬁnition (Conditional anonimity [41]). An anonymity automaton X satisﬁes→
conditional anonymity if for each i ∈ U and −o ∈ O∗ ,→o ]) > 0
PX ( [act(i)] ∩ [−'→o ] ) = PX ( [act(i)] |[act(j)] ) .
=⇒ PX ( [act(i)] | [−j∈U

The notion in Deﬁnition 4.3.8 is a natural probabilistic adaptation of trace anonymity
in [119]. It is emphasized that these anonymity notions are based on trace semantics
which is at the coarsest end in the linear time-branching time spectrum [39]. Hence
our adversary has less observation power than the one in [1], for example, wheresecurity notions are bisimulation-based.
Our choice of such a weak adversary is justiﬁed as long as we think of a passive
adversary—or an “eavesdropper”—which passively observe an execution of the protocol without actively taking part in it. In fact, each process semantics in the linear
time-branching time spectrum [39] has a corresponding testing scenario, an informal
description about what kind of observation will have the distinguishing power prescribed by the process semantics. The ability of a passive adversary coincides withthe testing scenario for the weakest process semantics in the spectrum, namely trace
semantics.

4.4

Verifying strong anonymity with probabilistic simulations

101

Probable innocence
The weaker notion of probable innocence—informally introduced in Deﬁnition 4.2.2—
is also formalized based on anonymity automata and their trace semantics. It is basedon the deﬁnition in [23].
4.3.10 Deﬁnition (Probable innocence [23]). We say an anonymity automaton X→
satisﬁes probable innocence if, for each i ∈ U and −o ∈ O∗ ,.
.
→– Neither of the probabilities PX ( j=i [act(j)]) and PX ( j=i [act(j)] | [−o ] ) is 0.
These appear as denominators in the following inequality.
– We have(n − 1)→
PX ( [act(i)] )PX ( [act(i)] | [−
o ])
.
.
≥
.
→
PX ( j=i [act(j)] )PX ( j=i [act(j)] | [−
o ])

(4.3)

Here n = |U| is the number of users.

4.4

Verifying strong anonymity with probabilistic
simulations

In this section we adapt the proof method [71, 72] for (non-deterministic) trace
anonymity to the probabilistic setting for strong (probabilistic) anonymity. In Section 4.1.2 we have presented its basic scenario. Now we shall describe its details, withall the notions therein (traces, simulations, etc.) interpreted probabilistically.

4.4.1

Anonymized automaton an(X )We start with the deﬁnition of an(X ), the anonymized version of an anonymity automaton X . Recall that the notion of strong anonymity is conditional: the adversary
has a-priori knowledge on who is more suspicious. In an anonymity automaton X ,the a-priori probability with which a user i is a culprit is given by PX ( [act(i)] ). Its
normalized, conditional version.
'
PX ( [act(i)] ∩ j∈U [act(j)] )def.
.
ri = PX ( [act(i)] |[act(j)] ) =PX ( j∈U [act(j)] )
j∈U
(4.4)
PX ( [act(i)] )=j∈U PX ( [act(j)] )(the equalities are due to Assumption 4.3.6) plays an important role in the following
deﬁnition of an(X ). The value ri is the conditional probability with which a user i
is a culprit, given that there is any culprit; we have i∈U ri = 1. Of course, for thevalues ri to be well-deﬁned, the anonymity automaton X needs to satisfy the following
reasonable assumption.

102

4

Case study: probabilistic anonymity

4.4.1 Assumption (There must be a culprit). For an anonymity automaton X ,"PX ( [act(j)] ) = 0 .

j∈UIntuitively, an(X ) is obtained from X by distributing the probability for an actor
action act(i) to each user j in proportion to rj .
4.4.2 Deﬁnition (Anonymized anonymity automaton an(X )). Given an anonymity
automaton X = (X, U, O, c, s), its anonymized anonymity automaton an(X ) is a quintuple (X, U, O, can , s), where can is deﬁned as follows. For each x ∈ X,
can (x)(act(i), u)can (x)(o, u)=j∈U ri · c(x)(act(j), u)= c(x)(o, u)

for i ∈ U and u ∈ {} + X,
for o ∈ O and u ∈ {} + X.

In the ﬁrst equation, the summand ri · c(x)(act(j), u) results from distributing theact(j)

probability c(x)(act(j), u) for a transition x −→ u, to a user i. This is illustrated in
the following ﬁgure: here U = {0, 1, . . . , n − 1} and q = c(x)(act(j), u).
•

In X

In an(X )act(0) [r0 · q]act(j) [q]
•

•
···

act(n − 1) [rn−1 · q] (4.5)•

The automaton an(X ) is “anonymized” in the sense of the following lemmas.
4.4.3 Lemma. Let X be an anonymity automaton. In its anonymized version an(X ) =(X, U, O, can , s) we have
rj · can (x)(act(i), u) = ri · can (x)(act(j), u)
for any i, j ∈ U, x ∈ X and u ∈ {} + X.
Proof. Obvious from the deﬁnition of can .



4.4.4 Lemma (an(X ) satisﬁes strong anonymity). Given an anonymity automaton
X , its anonymized version an(X ) satisﬁes strong anonymity in the sense of Deﬁnition 4.3.8.
→
Proof. Let −o = o1 , o2 , . . . , on  ∈ O∗ and i, j ∈ U. Moreover, assume
Pan(X ) ( [act(i)] ) = 0 and Pan(X ) ( [act(j)] ) = 0 ,4.4

Verifying strong anonymity with probabilistic simulations

103

hence ri = 0 and rj = 0. Then→
Pan(X ) ( [−o ] ∩ [act(i)] )= Pan(X ) ( act(i), o1 , o2 , . . . , on  )+ Pan(X ) ( o1 , act(i), o2 , . . . , on  )+ ···+ Pan(X ) ( o1 , o2 , . . . , on , act(i) )"s(x0 ) · can (x0 )(act(i), x1 ) · can (x1 )(o1 , x2 ) · · · · · can (xn )(on , )=x0 ,x1 ,...,xn ∈X"+s(x0 ) · can (x0 )(o1 , x1 ) · can (x1 )(act(i), x2 ) · · · · · can (xn )(on , )x0 ,x1 ,...,xn ∈X

+ ···
+

"

s(x0 ) · can (x0 )(o1 , x1 ) · can (x1 )(o2 , x2 ) · · · · · can (xn )(act(i), ) .

x0 ,x1 ,...,xn ∈X

We have the same equation for j instead of i. Hence by Lemma 4.4.3 we have→→
rj · Pan(X ) ( [−o ] ∩ [act(i)] ) = ri · Pan(X ) ( [−o ] ∩ [act(j)] ) .

(4.6)

This is used to show the equality of two conditional probabilities.
→
Pan(X ) ( [−o ] ∩ [act(i)] )→Pan(X ) ( [−o ] | [act(i)] ) =Pan(X ) ( [act(i)] )→o ] ∩ [act(j)] )ri Pan(X ) ( [−·=rj
Pan(X ) ( [act(i)] )→Pan(X ) ( [−o ] ∩ [act(j)] )=Pan(X ) ( [act(j)] )
→
=P
( [−
o ] | [act(j)] ) .
an(X )

4.4.2

by (4.6)
by deﬁnition of ri , rjForward/backward simulations for anonymity automata

We proceed to introduce appropriate notions of forward and backward simulations.
The (tedious) deﬁnition and a soundness theorem—existence of a forward/backward
simulation implies trace inclusion—come for free from the generic theory in Chapter 3.
This forms a crucial part of our simulation-based proof method.
4.4.5 Deﬁnition (Forward/backward simulations for anonymity automata). Let
X = (X, U, O, c, s) and Y = (Y, U, O, d, t) be anonymity automata which have thesame sets of users and observable actions.
A forward simulation from X to Y—through which Y forward-simulates X —is afunctionf : Y −→ DX

104

4

Case study: probabilistic anonymity

which satisﬁes the following inequalities in [0, 1].
s(x) ≤y∈Y t(y) · f (y)(x) for any x ∈ X,f(y)(x)·
c(x)(e,)≤d(y)(e,)for any y ∈ Y and e ∈ A,

x∈X



f
(y)(x)·
c(x)(e,x)≤d(y)(e,y)·f(y)(x )
x∈Xy ∈Y
for any y ∈ Y , e ∈ A and x ∈ X.
A backward simulation from X to Y—through which Y backward-simulates X —isa function
b : X −→ DY
which satisﬁes the following inequalities in [0, 1].
t(y)for any y ∈ Y ,x∈X s(x) · b(x)(y) ≤ b(x)(y)·d(y)(e,)forany x ∈ X and e ∈ A,
c(x)(e, ) ≤
y∈Y





c(x)(e,
x
)
·
b(x
)(y
)
≤
b(x)(y)·d(y)(e,
y
)

x ∈X
y∈Y
for any x ∈ X, e ∈ A and y  ∈ Y .
This deﬁnition (similar to the “probabilistic simulations” in Example 3.2.13) is an instantiation of the general, coalgebraic notions of forward/backward simulations (Definitions 3.2.8 and 3.2.9). More speciﬁcally, the two parameters T and F in the genericdeﬁnition are instantiated as in Section 4.3.2.
4.4.6 Theorem (Soundness of forward/backward simulations). Assume there is aforward (or backward) simulation from one anonymity automaton X to another Y.
Then we have trace inclusion
P X  PY ,→where the order  is deﬁned to be the pointwise order: for each −a ∈ A+ ,→→a ) ≤ PY (−
a) .
PX (−
Proof. We know (Lemma 4.3.4) that the notions of traces and simulations for anonymity
automata are instantiations of the general, coalgebraic notions in the previous chapters. Therefore we can appeal to the general soundness theorem (Theorem 3.3.2).


4.4.3

Probabilistic anonymity via simulations

We shall use the material in Section 4.4.1 and 4.4.2 to prove the validity of oursimulation-based proof method (Theorem 4.4.11).
The following lemma—which essentially says PX  Pan(X ) —relies on the way theautomaton an(X ) is constructed. The proof is a bit more complicated here than in
the non-deterministic setting [71, 72].
4.4.7 Lemma. Let X be an anonymity automaton. Assume there exists a forward
or backward simulation from an(X ) to X —through which X simulates an(X ). Then
their trace semantics are equal:
PX = Pan(X ) .

4.4

Verifying strong anonymity with probabilistic simulations

105

Proof. By the soundness theorem (Theorem 4.4.6) we have
PX

Pan(X ) ,(4.7)

where refers to the pointwise order between functions A+ ⇒ [0, 1]. We shall showthat this inequality is in fact an equality.
First we introduce an operation obs which acts on anonymity automata. Intuitively, obs(Y) is obtained from Y by replacing all the diﬀerent actor actions act(i)with single act(sb)—sb is for “somebody.” This conceals actor actions in Y; hence
obs(Y) only carries information on the observable actions of Y.
•

In X
act(0) [q0 ]In obs(X )···act(n − 1) [qn−1 ]•act(sb) [q0 + · · · + qn−1 ]

•

(4.8)
•

Formally,
4.4.8 Deﬁnition (Anonymity automaton obs(Y)). Given an anonymity automaton
Y = (Y, U, O, d, t), we deﬁne an automaton obs(Y) as the tuple (Y, {sb}, O, dobs , t)where:– sb is a fresh entity,– dobs is a function

dobs : Y −→ D Aobs × {} + Aobs × Y
where Aobs = O + {act(sb)}, deﬁned by:
dobs (y)(act(sb), u) =i∈U d(y)(act(i), u)
dobs (y)(o, u)= d(y)(o, u)

for y ∈ Y and u ∈ {} + Y ,for y ∈ Y , o ∈ O and u ∈ {} + Y .

The following fact is obvious.
4.4.9 Sublemma. For an anonymity automaton X , obs(X ) and obs(an(X )) are identical.

The following fact is crucial in the proof of Lemma 4.4.7. Two automata Y andobs(Y), although their trace semantics distributes over diﬀerent sets, have the same
sum of probabilities taken over all executions.
4.4.10 Sublemma. For an anonymity automaton Y,
"
"
→
−
→
PY (−
a)=
Pobs(Y) ( a ) .
→
−
a ∈A+

→
−
a ∈(Aobs )+Recall that A = O + {act(i) | i ∈ U} and Aobs = O + {act(sb)}.

106

4

Case study: probabilistic anonymity

Proof. From the deﬁnition of trace semantics (Deﬁnition 4.3.3), the sublemma isproved by easy calculation.

We turn back to the proof of Lemma 4.4.7. We argue by contradiction—assume→→a0 ) 
that the inequality in (4.7) is strict. That is, there exists−a0 ∈ A+ such that PX (−
→
−
→
−
→
−
−
→
−
P
(
a
)

P
(
a
).
However,
Pan(X ) (a0 ). Then, by (4.7) we have →++X
an(X )
a ∈A
a ∈A


→
−

→
−
a ∈A+ PX ( a ) =

=
=



→
−

→
−
P
( a )a ∈(Aobs )+ obs(X )by Sublemma 4.4.10→−P( a )a ∈(Aobs )+ obs(an(X ))by Sublemma 4.4.9



→
−



−
→
→
−
a ∈A+ Pan(X ) ( a )by Sublemma 4.4.10.

This contradiction concludes the proof of Lemma 4.4.7.



Now we are ready to state our main result for verifying strong anonymity.
4.4.11 Theorem (Strong anonymity via simulations). If there exists a forward or
backward simulation from an(X ) to X , then X satisﬁes strong anonymity.
Proof. By Lemma 4.4.7 we have PX = Pan(X ) . Moreover, by Lemma 4.4.4, an(X )is strongly anonymous. This proves strong anonymity of X : recall that strong
anonymity is a property deﬁned in terms of traces (Deﬁnition 4.3.8).

4.4.12 Example (Dining cryptographers). We demonstrate our simulation-based
proof method by applying it to the DC protocol.
Let X = {x, y0 , y1 , y2 } be the state space of XDC . Its anonymized version an(XDC )has the same state space; for notational convenience the state space of an(XDC ) isdenoted by X  = {x , y0  , y1  , y2  }. It is veriﬁed by easy calculation that the following
function f : X → D(X  ) is a forward simulation from an(XDC ) to XDC .
⎤⎡ 
y0 → p0 +pp01 +p2
p
f (y0 ) = f (y1 ) = f (y2 ) = ⎣ y1  → p0 +p11 +p2 ⎦f (x) = [x → 1]y2 → p0 +pp21 +p2
By Theorem 4.4.11 this proves (probabilistic) strong anonymity of XDC , hence of the
DC protocol.

4.5

Verifying probable innocence with probabilistic
simulations

In this section we present a simulation-based proof method for the weaker notion ofprobable innocence. Although the basic idea is similar to that in the last section forstrong anonymity, there are certain diﬀerences as well. Most notably, now we haveto ﬁnd a simulation from X to its “innocent version” inno(X ); this is in the opposite
direction of what we do for strong anonymity.
The basic scenario is as follows.

4.5

Verifying probable innocence with probabilistic simulations

107

1. We model an anonymizing protocol as an anonymity automaton X .
2. We construct the innocent version inno(X ) of X . Here it is not much of ourconcern whether inno(X ) satisﬁes probable innocence or not. Rather inno(X )is thought of as the automaton describing the upper bound of admissible information leakage on who is the culprit. In fact, by examining the construction ofinno(X ), we can prove that
PX  Pinno(X )X satisﬁes probable innocence.

=⇒

(4.9)

3. We ﬁnd a simulation from X to inno(X ). By the soundness theorem this yields
trace inclusion PX  Pinno(X ) , which by (4.9) proves that X satisﬁes probableinnocence.
Although this scenario is somewhat diﬀerent from the one for strong anonymity (orfor non-deterministic trace anonymity [71, 72]), they are the same in that:– we model a (trace-based) anonymity property as the “idealized version” of X
(such as an(X ) or inno(X ));– by ﬁnding a simulation and then appealing to the soundness theorem, we showthat the property is transferred from the idealized version to the original X .
Therein the construction of the “idealized version of X ” must be much tailored to thespeciﬁc property to be veriﬁed.

4.5.1“Innocent” automaton inno(X )We describe the construction of the innocent version inno(X ) of a given anonymity
automaton X . To illustrate the intuition, let us assume that the a-priori suspicion is
uniformly distributed, that is, ri = 1/n where U = {0, 1, . . . , n − 1}. The automatoninno(X ) is obtained by replacing actor actions in X as follows: compare it with (4.5).
•

In X

In inno(X )act(0) [ 2q ]act(j) [q]
•

•
···

act(n − 1) [ 2q ](4.10)•

There is an obvious problem in this deﬁnition: the resulting inno(X ) may not be an
anonymity automaton, since the probabilities q/2 appearing n times can add up to
more than 1. We shall call such an automaton an extended anonymity automaton.
4.5.1 Deﬁnition (Extended anonymity automata). An extended anonymity automaton (X, U, O, c, s) is the same thing as an anonymity automaton (Deﬁnition 4.3.1),
except for the fact that c is a function of the typeX −→ V A × {} + A × X

108

4

Case study: probabilistic anonymity

rather than X → D(A × {} + A × X). Here the operation V is such that6
VY = [0, ∞]Y = d : Y → [0, ∞] .

(4.11)The operation V canonically extends to a monad, which we shall call the valuationmonad.
Given an extended anonymity automaton X , its trace semantics
PX ∈ V(A+ )(4.12)

is deﬁned exactly in the same way as for anonymity automata (Deﬁnition 4.3.3).
Given an anonymity automaton X , it can be thought of as an extended anonymity
automaton because there is an inclusion map DY → VY :X

c→

D(A × {} + A × X)→

V(A × {} + A × X) .

(4.13)

Therefore we are overriding the notation PX in (4.12). This is not a problem, sincefor an anonymity automaton X the following two trace semantics obviously coincide.
– Its trace semantics (Deﬁnition 4.3.3) as an anonymity automaton, and– the trace semantics of the extended anonymity automaton induced by (4.13).
Before giving a formal deﬁnition of inno(X ), note that the core inequality (4.3) inthe deﬁnition of probable innocence is equivalent to the following one, which uses thea-priori distribution of suspicion (ri )i∈U from (4.4):→
PX ( [act(i)] ∩ [−
o ])

≤

'
 → 
(n − 1)ri· PX[act(j)] ∩ [−o] .
1 + (n − 2)ri

(4.14)j∈U

The equivalence is shown by the following easy calculation:(n − 1)⇐⇒⇐⇒⇐⇒→
PX ( [act(i)] | [−o ])PX ( [act(i)] ).
.
≥→PX ( j=i [act(j)] )PX ( j=i [act(j)] | [−o ])→−(n − 1)ri
PX ( [act(i)] | [ o ] )

.
≥
→
r
P (
[act(j)] | [−o ])j=i jX

j=i→(n − 1)rio ])PX ( [act(i)] | [−.
≥→1 − riPX ( j=i [act(j)] | [−o ])'(n − 1)ri→→o ]) ≤· PX ([act(j)] | [−o ])PX ( [act(i)] | [−1 − ri
j=i

⇐⇒



'
(n − 1)ri(n − 1)ri→→
1+o ]) ≤· PX ([act(j)] | [−o ]) ,PX ( [act(i)] | [−1 − ri1 − rij∈Ufrom which (4.14) follows immediately.
6 The range of d ∈ VY is [0, ∞] including ∞. This choice is made because, in order to apply thecoalgebraic theory of traces and simulations, VY needs to carry a Cppo-structure. In particular,
any increasing ω-chain in VY must have its upper bound in VY .

4.5

Verifying probable innocence with probabilistic simulations

109

4.5.2 Deﬁnition (Anonymity automaton inno(X )). Given an anonymity automaton
X = (X, U, O, c, s), its innocent version inno(X ) is an extended anonymity automaton
given by the 5-tuple (X, U, O, cinno , s), where cinno is deﬁned as follows. For eachx ∈ X,
cinno (x)(act(i), u)="(n − 1)ri·c(x)(act(j), u)
1 + (n − 2)rij∈Ucinno (x)(o, u)= c(x)(o, u)

for i ∈ U and u ∈ {} + X,
for o ∈ O and u ∈ {} + X.

The coeﬃcient (n − 1)ri /(1 + (n − 2)ri ) comes from the inequality (4.14). The definition agrees with the informal description (4.10) when the a-priori suspicion (ri )i∈U
is uniform.

4.5.2

Probable innocence via simulations

The intuition about the automaton inno(X ) is that it represents the upper boundof admissible information leak. This intuition is put precise in the following lemma,
which is a crucial step in our simulation-based proof method for probable innocence.
4.5.3 Lemma. If we have
PX  Pinno(X )that is,→∀−a ∈ A+ .

→→PX (−a ) ≤ Pinno(X ) (−a) ,then the anonymity automaton X satisﬁes probable innocence (Deﬁnition 4.3.10).
Proof. By calculation much like the one which shows the equality (4.6) in the proof
of Lemma 4.4.4, we obtain the following.
→o ] ∩ [act(i)] ) =Pinno(X ) ( [−"(n − 1)ri→·
PX ( [−o ] ∩ [act(j)] )1 + (n − 2)ri

(4.15)j∈U

By assumption, we have→→
PX ( [−o ] ∩ [act(i)] ) ≤ Pinno(X ) ( [−o ] ∩ [act(i)] ) ,which, together with (4.15), derives (4.14).

The assumption of Lemma 4.5.3—trace inclusion PX  Pinno(X ) —shall be shownby ﬁnding a probabilistic simulation. Now that inno(X ) is an extended anonymity
automaton, we have to adapt the notion of probabilistic simulations and its soundness
result to the extended setting. In terms of the generic theory in the previous chapters,
this corresponds to changing the parameter T from D to V.
4.5.4 Deﬁnition (Forward/backward simulations, extended). Let X and Y be extended anonymity automata. A forward (or backward) simulation from X to Y is thesame thing as a forward (or backward) simulation for anonymity automata (Deﬁnition 4.4.5), except that

110

4

Case study: probabilistic anonymity– we have now V in place of D, and– the inequalities are interpreted in [0, ∞] rather than in [0, 1].
For example, a forward simulation from X to Y is a function
f : Y −→ VX
which satisﬁes suitable inequalities as in Deﬁnition 4.4.5.
4.5.5 Theorem (Soundness of simulations, extended). If there is a forward or backward simulation from an extended anonymity automaton X to another Y, then we
have trace inclusion
PX  P Y ,that is,→∀−a ∈ A+ .

→→PX (−a ) ≤ PY (−a) .

Proof. The general, coalgebraic theory of traces in the previous chapters applies to the
choice of parameters T = V and F = A × {} + A × , in which case the coalgebraic
notion of (T, F )-systems instantiates to extended anonymity automata. Moreover, thecoalgebraic notions of trace semantics and simulations instantiate to the corresponding
notions for extended anonymity automata (Deﬁnitions 4.5.1 and 4.5.4). Therefore thestatement is an instance of the general soundness theorem (Theorem 3.3.2).

4.5.6 Theorem (Probable innocence via simulations). If there exists a forward or
backward simulation from X to inno(X ), then X satisﬁes probable innocence.
Proof. By the soundness theorem (Theorem 4.5.5) we have PX  Pinno(X ) ; by Lemma 4.5.3
this implies X ’s probable innocence.


4.6

Related work

4.6.1

Probabilistic non-interference

In the theory of programming languages, a property called non-interference [97] has
attracted much attention. Intuitively, a program C satisﬁes non-interference if there isno “insecure” information ﬂow from variables with high conﬁdentiality (high variables)
to those with low conﬁdentiality (low variables).
Let us put it slightly more formally. By a memory state we mean a list of pairs ofa variable name and a value (such as [H=0,L=0]). Assume that two memory states
μ and ν diﬀer only in high variables (μ =L ν). Non-interference of a program C
requires that the execution of C with the initial memory state μ is observationallyindistinguishable from that with ν. In particular, if μ and ν  are the memory states
after these executions, respectively, then they have to agree on low variables:
μ =L ν,μ  μ ,Cν  νC=⇒μ =L ν  .

A possible variant of the formal deﬁnition concerns C’s termination as well.

4.6

Related work

111

Volpano and Smith [138] claim the importance of probabilistic aspects in noninterference. The leading example is in a simple programming language which has
the multi-threading construct C | C  which denotes running two threads C and C in parallel, in an interleaving manner. Even though there is no explicit probabilistic
construct in the language, a probabilistic scheduler —a mechanism that determines
which thread to execute ﬁrst—introduces probability in an operational model. In [138]a simple example is presented in which insecure information ﬂow emerges only in aprobabilistic setting (but not in a non-deterministic setting).
A deﬁnition of probabilistic non-interference (disregarding termination for thesake of simplicity) can be presented as follows. Let μH , νH be memory states ofhigh variables; μL , μL be states of low variables. A program C satisﬁes probabilistic
non-interference if, for every μH , νH , μL and μL ,Pr(μL  μL | initial high-memory is μH )C

= Pr(μL  μL | initial high-memory is νH ) .
C

Notice similarity to the notion of strong anonymity (Deﬁnition 4.2.1). One can thinkCof the change of low-memory μL  μL as an “observation”; and the initial highmemory as a “culprit,” i.e. the information that we want to disguise. This similarity
between the two notions—(strong) probabilistic anonymity and probabilistic noninterference—suggests that a technique to ensure one of these properties can be used
to ensure the other property as well.
Use of type systems is a standard technique to ensure that a certain piece ofprogram satisﬁes a certain desirable property, such as non-interference. A type system typically has typing rules, and a soundness theorem stating: if a program C istypable—meaning that we can derive a typing judgment for C using the given rules—
then C satisﬁes the desired property. One big advantage of the type-based approachis that type systems are often accompanied with typing algorithms that eﬀectively
determine whether a program is typable or not.
For probabilistic non-interference, a number of type systems have been proposed [117,138]. They are in principle extensions of the type system in [126] that ensures nondeterministic notion of non-interference. For example, the following program with an
obvious (but indirect) insecure information ﬂow
if H=0 then L=0 else L=1;

(4.16)

is typable in none of the type systems in [117, 126, 138]. Moreover, any program
containing this piece is not typable either, because of the compositional way of typederivation in these type systems.
Because of this fact the type systems from [117, 138] do not seem widely applicable to veriﬁcation of anonymizing protocols. Consider the example of Dining
Cryptographers: a natural representation of the protocol as a program should include
a piece like (4.16) expressing “if a cryptographer is the payer, then she lies about herannouncement.” Therefore such a program for DC is not typable.

112

4

Case study: probabilistic anonymity

In the DC protocol each cryptographer’s behavior is certainly inﬂuenced by the
information to be hidden; this is why the type systems from [117, 138] do not seemto apply. Nevertheless, when three cryptographers are “composed” in the way prescribed by the protocol, they manage to hide who is the payer. In this sense, broken
anonymity is not compositional. A type system, if one wants to use it for veriﬁcationof anonymizing protocols, needs to address such a non-compositional phenomenon.
However potential complexity of such a type system would make it harder to comeup with a useful typing algorithm.

4.6.2

Process algebraic techniques

In the current work we have presented anonymizing protocols in the form of automata,or transition systems. Using process algebraic terms or process terms—such as P +Q for “non-deterministic choice between P and Q”—is another way of expressing
processes such as anonymizing protocols. In fact, a process term induces a transition
system via the structural operational semantics of the process algebra [3], hence a
process algebra can be seen as a “programming language” which denotes transition
systems.
One merit of using process algebras is that an algebraic structure in process terms
often aids reasoning about properties of the term (more precisely, properties of theautomaton denoted by the term). For example, one can employ inductive reasoning on
the (inductive) construction of process terms. Many tools are available for analyzing
properties of process terms.
Process algebraic techniques have been successfully applied in many anonymity
applications. In [27], the MUTE anonymous ﬁle-sharing system [113] is analyzed byrepresenting the protocol as a π-calculus term. The analysis led to discovery of a ﬂaw,
which is detected by the ABC bisimulation checker [20] for the π-calculus. A detailed
account of the ﬂaw is in [28]. In [29] a general framework for automatic checking ofanonymity is proposed; the framework is based on the process algebra μCRL. However, all the work mentioned here is done in non-deterministic settings. A probabilistic
framework of such a kind which would aid automatic error-detection/veriﬁcation ofanonymity is one interesting direction of future work.
The probabilistic π-calculus [53, 105] is a process algebra that can model probabilistic choices. A process term in that calculus yields a probabilistic automaton [121]as its operational model. It is used to model anonymity protocols in [15]. In a similar direction, recent work [24] uses a variant of CCS with an additional operator forprobabilistic choices.

4.7

Summary and future work

We have extended the simulation-based proof method [71, 72] for non-deterministic
anonymity to apply to the notion of strong probabilistic anonymity [15]. For the move
we have exploited a generic theory of traces and simulations developed in Chapters 2

4.7

Summary and future work113

and 3, in which the diﬀerence between non-determinism and probability is just a
diﬀerent choice of a parameter. Additionally a simulation-based proof method for the
weaker notion of probable innocence is introduced.
The DC example in this chapter fails to demonstrate the usefulness of our proof
method. For this small example direct calculation of trace distribution is not hard.
A real beneﬁt would arise in theorem-proving anonymity of an unboundedly large
system (which we cannot model-check). In fact, the non-deterministic version of ourproof method is used to theorem-prove anonymity of a voting protocol with arbitrary
many voters [71]. A probabilistic case study of such kind is currently missing.

114

4

Case study: probabilistic anonymity

Chapter 5Foundational study:
concurrency and the microcosm principle

Coalgebras are categorical presentations of state-based systems. In investigating parallel composition of coalgebras (realizing concurrency), we observe that the same
algebraic theory is interpreted in two diﬀerent domains in a nested manner, namely:in the category of coalgebras, and in the ﬁnal coalgebra as an object in it. This phenomenon is what Baez and Dolan have called the microcosm principle, a prototypicalexample of which is “a monoid in a monoidal category.” In the current work we obtaina formalization of the microcosm principle in which such a nested model is expressedcategorically as a suitable lax natural transformation. An application of this accountis a general compositionality result which supports modular veriﬁcation of complex
systems.

5.1

Overview

Design of systems with concurrency is nowadays one of the mainstream challenges
in computer science [91]. Concurrency is everywhere: with the Internet being thebiggest example and multi-core processors probably the smallest; also in a modular,
component-based architecture of a complex system, its components collaborate in a
concurrent manner. However numerous diﬃculties have been identiﬁed in getting
concurrency right. For example, a system’s exponentially growing complexity is oneof the main obstacles. One way to cope with it is a modular veriﬁcation method inwhich correctness of the whole system C1  · · ·  Cn is established using correctnessof each component Ci . Compositionality—meaning that the behavior of C  D isdetermined by the behavior of C and that of D—is an essential property for such a
modular method to work.
115

116

5

Foundational study: concurrency and the microcosm principle

5.1.1

Coalgebras as systems

The work described in this chapter is a starting point of our research program aimed
at better understanding of the mathematical nature of concurrency. In its course
we shall use coalgebras as presentations of systems to be run in parallel. The useof coalgebras as an appropriate abstract model of state-based systems is increasingly
established (see Chapter 1); the notion’s mathematical simplicity and clarity provide
us with a sound foundation for our exploration. We recall the following table whichsummarizes how ingredients of the theory of systems are presented as coalgebraic
constructs. The same table appeared before as (1.9)
systemcoalgebra

coalgebraicallybehavior-preserving map
morphism of coalgebras

FX

FX
X

X

Ff

f

FY

behaviorby coinduction
FX
FZ

Y

X

c

ﬁnal
beh(c)

Z(5.1)

This view of “coalgebras as systems” has been successfully applied in the category
Sets of sets and functions, in which case the word “behavior” in (5.1) refers (roughly)
to the one modulo bisimilarity. Additionally, in Chapters 2 and 3 we have shown that“behavior” in the table can also refer to trace semantics, by moving from Sets to asuitable Kleisli category.

5.1.2

Compositionality in coalgebras

We start with the following question: what is “compositionality” in this coalgebraic
setting? Conventionally compositionality is expressed as:
C1 ∼ C2andD 1 ∼ D2=⇒

C1  D1 ∼ C2  D2 ,where the relation ∼ denotes the behavioral equivalence of interest. If this is the casethe relation ∼ is said to be a congruence, with its oft-heard instance being “bisimilarity
is a congruence.”
When we interpret “behavior” in compositionality as the coalgebraic behavior induced by coinduction (see (5.1)), the following equation comes natural as a coalgebraic
presentation of compositionality.







FY
FX 
FX  FY= beh cbeh c  d
 beh d
Y
Y
X
X

(5.2)

But a closer look reveals that the two “parallel composition operators”  in the equation have in fact diﬀerent types: the one on the left has a type

CoalgF × CoalgF −→ CoalgF ,composing coalgebras as systems;

5.1

Overview

117

while the one on the right has a type1
Z × Z −→ Z ,composing states of the ﬁnal coalgebra Z as behaviors.
∼=
Moreover, the two domains are actually nested: the latter one Z →F Z is an objectof the former one CoalgF .

5.1.3

The microcosm principle

What we have just observed is one instance—which is not often claimed explicitly incomputer science—of the microcosm principle as it is called by Baez and Dolan [9]. It
refers to a phenomenon that the same algebraic theory (or algebraic “speciﬁcation,”
consisting of operations and equations) is interpreted twice in a nested manner, oncein a category C and the other time in its object X ∈ C. This is not something
very unusual, because “a monoid in a monoidal category” constitutes a prototypicalexample.
monoidal category C

monoid X ∈ C⊗:C×C→C
I∈C

multiplicationunit

I ⊗X ∼=X∼=X ⊗I

unit lawX ⊗ (Y ⊗ Z) ∼= (X ⊗ Y ) ⊗ Z

associativity lawμX ⊗X →XηI→X
X X ⊗X X
X
X ⊗X ⊗X

X ⊗X

X ⊗X

X

(5.3)

Notice here that the outer operation ⊗ appears in the formulation of the inner operation μ. Moreover, to be precise, in the inner “equations” the outer isomorphisms
should be present in suitable places. Hence this monoid example demonstrates that,in such nested algebraic structures, the inner structure depends on the outer. Whatis a mathematically precise formalization of such nested models? Answering thisquestion is a main goal of this chapter.
Such a formalization has been done in [9] when algebraic theories are speciﬁedin the form of opetopes. Here instead we shall formalize the microcosm principle for
Lawvere theories [90], whose role as categorical representation of algebraic theories
has been recognized in theoretical computer science.
As it turns out, our formalization looks like the situation on
1
the right. Here L is a category (a Lawvere theory) representing an⇓Xalgebraic theory; an outer model C is a product-preserving functor L
CATC
L → CAT; and an inner model X is a lax natural transformation.
The whole setting is 2-categorical: 2-categories (categories in categories) serve as an
appropriate basis for the microcosm principle (algebras in algebras).
1 At this stage the presentation remains sloppy for the sake of simplicity. Later in technical sections
the ﬁrst composition operator will be denoted by ⊗ ; and the second composition operator will havethe type Z ⊗ Z → Z instead of Z × Z → Z.

118

5

Foundational study: concurrency and the microcosm principle

5.1.4

Applications to coalgebras: parallel composition via sync

The categorical account we have sketched above shall be applied to our original question about parallel composition of coalgebras. As a main application we prove a
generic compositionality theorem. For an arbitrary algebraic theory L, compositionality like (5.2) is formulated as follows: the “behavior” functor beh : CoalgF → C/Z(via coinduction) preserves an L-structure. This general form of compositionality
holds under the following assumptions: C has an L-structure and F : C → C laxpreserves the L-structure.
Turning back to the original setting (5.2) of “coalgebraic compositionality,” thesegeneral assumptions read roughly as follows: the base category C has a binary operation ; and the endofunctor F comes with a natural transformation sync : F X 
F Y → F (X  Y ). Essentially, this sync is what lifts  on C to  on CoalgF , hence“parallel composition via sync.” It is called a synchronization because it speciﬁes theway two systems synchronize with each other. In fact, for a ﬁxed functor F there
can be diﬀerent choices of sync (such as CSP-style vs. CCS-style), which in turn yielddiﬀerent “parallel composition” operators on the category CoalgF .

5.1.5

Organization of the chapter

We shall not dive into our 2-categorical exploration from the beginning. In Section 5.2, we instead focus on one speciﬁc algebraic theory, namely the one for parallel
composition of systems. Our emphasis there is on the fact that the sync natural transformation essentially gives rise to parallel composition , and the fact that equational
properties of  (such as associativity) can be reduced to the corresponding equational
properties of sync.
These concrete observations will provide us with intuition for abstract categoricalconstructs in Section 5.3, where we formalize the microcosm principle for an arbitrary
Lawvere theory L. In Section 5.4 this formalization is applied to our original question
on concurrency; here results on coalgebras such as compositionality are proved in theirfull generality and abstraction. Additionally in Section 5.5 we address some speciﬁc
issues which arise in a Kleisli category, where coinduction captures trace semantics.
In the current work we shall focus on strict algebraic structures on categories
in order to avoid complicated coherence issues. This means for example that weonly consider strictly monoidal categories for which the isomorphisms in (5.3) are infact equalities. Investigation of “pseudo” or “strong” algebraic structures (such as
not necessarily strictly monoidal categories) is left as future work: some preliminary
observations are presented in Section 5.3.3.

5.1.6

Related work

Our interest is similar to that of studies of bialgebraic structures in computer science(such as [12, 67, 75, 78, 79, 116, 134]), in the sense that we are also concerned withalgebraic structures on coalgebras as systems. Our current framework is distinguishedin the following aspects.

5.2

Parallel composition of coalgebras

119First, we handle equations in an algebraic theory as an integral part of our approach. Equations such as associativity and commutativity appear explicitly as commutative diagrams in a Lawvere theory L. We beneﬁt from this explicitness in e.g.
spelling out a condition for the generic associativity result (Theorem 5.2.4). In contrast, in the bialgebraicstudies an algebraic theory is presented either by an endo$
functor X → σ∈Σ X |σ| or by a monad T . In the former case equations are simply
not present; in the latter case equations are there but not as explicitly as in a Lawvere
theory.
Secondly and more importantly, by considering higher-dimensional, nested algebraic structures, we can now compose diﬀerent coalgebras as well as diﬀerent states ofthe same coalgebra. In this way the current work can be seen as a higher-dimensional
extension of the existing bialgebraic studies (the existing studies focus on “inner”
algebraic structures).

5.2

Parallel composition of coalgebras

5.2.1

Parallel composition via sync natural transformation

Let us start with the equation (5.2), a coalgebraic representation of compositionality.
The operator  on the left is of type CoalgF × CoalgF → CoalgF . It is natural torequire functoriality of this operation, making it a bifunctor. A bifunctor—especiallyan associative one which we investigate later in Section 5.2.3—plays an important rolein various applications of category theory. Usually such an (associative) bifunctor iscalled a tensor and denoted by ⊗ , a convention that we also follow.2 Therefore the“compositionality” statement now looks as follows.






FY
FY
FX
FX 
 beh d⊗ dbeh c
= beh c

Y
Y
X
X

(5.4)

The ﬁrst question is: when do we have such a tensor ⊗ on CoalgF ? In many applications of coalgebras, it is obtained by lifting a tensor ⊗ on the base category C to
CoalgF .3 Such a lifting is possible in presence of a natural transformation
syncX,Y : F X ⊗ F Y −→ F (X ⊗ Y ) ,used in
FY
FX
c
⊗ d
Y
X

:=

F (X ⊗ Y )syncX,Y.
FX ⊗ FY
c⊗d
X ⊗Y

(5.5)

2 Hence what is called a tensor here in Section 5.2.1 is just a bifunctor, possibly satisfying equational axioms such as associativity. Later in Section 5.2.3 we investigate its equational properties.
3 We use boldface ⊗ for a tensor on Coalg
F to distinguish it from ⊗ on C.

120

5

Foundational study: concurrency and the microcosm principle

We shall call this sync a synchronization because its computational meaning is indeed
a speciﬁcation of the way two systems synchronize. This will be illustrated in the
coming examples.
Once we have an outer parallel composition ⊗ in the form of a tensor, an inner
operator  which composes behaviors (i.e. states of the ﬁnal coalgebra) is also obtained
immediately by the following coinduction.
F (Z ⊗ Z)
⊗ζ
ζ⊗
Z ⊗Z



FZ
ﬁnal ζ
Z(5.6)

Compositionality (5.4) is straightforward by ﬁnality: both sides of the equation are
the unique coalgebra morphism from c ⊗ d to the ﬁnal ζ. The following theorem
summarizes the observations so far.
5.2.1 Theorem (Coalgebraic compositionality). Assume that a category C has atensor ⊗ : C × C → C and an endofunctor F : C → C has a natural transformation
syncX,Y : F X ⊗ F Y → F (X ⊗ Y ). If moreover there exists a ﬁnal F -coalgebra∼=
F Z, then:
ζ:Z→
1. The tensor ⊗ on C lifts to an “outer” tensor⊗ : CoalgF × CoalgF −→ CoalgF ,which we understand as an “outer” composition operator.
2. We obtain an “inner” composition operator : Z ⊗ Z → Z by coinduction (5.6).
3. Between the two composition operators the compositionality property (5.4) holds.

We can put the compositionality property (5.4) in more abstract terms as “the functor
beh : CoalgF → C/Z preserves the tensor,” meaning that the following diagram
commutes.
beh × beh
CoalgF × CoalgF
C/Z × C/Z⊗⊗
CoalgF
C/Z
beh
Here the tensor ⊗ on the slice category C/Z is given as follows, using the innercomposition .
X
Y 
f , g
Z
Z

⊗
−→

X ⊗Y
f ⊗g
Z ⊗Z

Z

(5.7)

5.2

Parallel composition of coalgebras

121

The point of Theorem 5.2.1 is as follows. Those parallel composition operators
which are induced by sync are well-behaved ones: good properties like compositionality come for free. We shall present some examples in Section 5.2.2.
5.2.2 Remark. The view of parallel composition of systems as a tensor structure
on CoalgF has been previously presented in [70]. The interest there is in categoricalstructures on CoalgF and not so much in properties of parallel composition such ascompositionality. In [70] and other references an endofunctor F with sync (equippedwith some additional compatibility) is called a monoidal endofunctor.4

5.2.2

ExamplesIn Sets: bisimilarity is a congruence
We shall focus on (ﬁnitely branching) LTSs, and bisimilarity as their process semantics. For this purpose it is appropriate to take Sets as our base category C andPﬁn (Σ × ) as the functor F (see Section 1.3.2). We use Cartesian products as atensor on Sets. This means that a composition of two coalgebras has the product of
the two state spaces as its state space, which matches our intuition. The functor Pﬁn
in F is the ﬁnite powerset functor; the ﬁniteness assumption is needed for existenceof a ﬁnal F -coalgebra. In Section 1.3.2 we sketched that a ﬁnal F -coalgebra capturesbisimilarity via coinduction.
In considering parallel composition of LTSs, the following three examples are wellknown ones.5a– CSP-style [55]: a.P  a.Q → P  Q. For the whole system to make an a-action,
each component has to make an a-action.
τ– CCS-style [99]: a.P  a.Q → P  Q, assuming Σ = {a, b, . . . } ∪ {a, b, . . . } ∪ {τ }.
When one component outputs on a channel a and the other inputs from a, then
the whole system makes an internal τ move.
a|b– ACP-style [13]: a.P  b.Q → P  Q. The way processes interact with eachother is parametrized by a partial binary operation | on Σ. In fact, suitablechoices of | realize CSP- and CCS-style synchronization.
In fact, each of these diﬀerent ways of synchronization can be represented by a suitable
4 Later in Section 5.3 we will observe that a functor F with sync is a special case of a lax Lfunctor. Such a functor F with sync is usually called a monoidal functor (as opposed to a lax
monoidal functor), probably because it preserves (inner) monoid objects; see Proposition 5.3.13.1.
5 Here we focus on synchronous interaction. All the process algebras mentioned here have anadditional kind of interaction, namely an “interleaving” one; see Remark 5.2.3.

122

5

Foundational study: concurrency and the microcosm principle

sync natural transformation.
Pﬁn (Σ × X) × Pﬁn (Σ × Y )(u, v)(u, v)(u, v)

Pﬁn Σ × (X × Y )−→syncCSP
X,Y

syncCCSX,Y

syncACP
X,Y



−→
−→
−→

(a, (x, y)) | (a, x) ∈ u ∧ (a, y) ∈ v(τ, (x, y)) | (a, x) ∈ u ∧ (a, y) ∈ v



(a|b, (x, y)) |(a, x) ∈ u ∧ (b, y) ∈ v ∧ a|b is deﬁned

By Theorem 5.2.1, each of these gives (diﬀerent) ⊗ on CoalgF , and  on Z; moreover
the behavior functor beh satisﬁes compositionality (5.4). In other words: bisimilarity
is a congruence with respect to CSP-, CCS- and ACP-style parallel composition.
5.2.3 Remark. As mentioned in Section 5.1, in some ways the current work can beseen as an extension of the bialgebraic studies started in [134]. However there is alsoa drawback, namely the limited expressive power of sync : F X ⊗ F Y → F (X ⊗ Y ).
Our sync speciﬁes the way an algebraic structure interacts with a coalgebraic one.
In this sense it is a counterpart of a distributive law ΣF ⇒ F Σ in [134] representing
operational rules, where Σ is a functor induced by an algebraic signature. However
there are many common operational rules which do not allow representation of theform ΣF ⇒ F Σ; therefore in [134] the type of such a distributive law is eventuallyextended to Σ(F × id) ⇒ F Σ∗ for enhanced expressive power. The class of rules
representable in this extended form coincides with the class of so-called GSOS-rules.
At present it is not clear how we can make a similar extension for our sync;
consequently there are some operational rules which we cannot model by sync. Oneaimportant example is an interleaving kind of interaction—such as a.P  Q → P  Q
which leaves the second component unchanged. This is taken care of in [134] by theidentity functor (id) appearing on the left-hand side of Σ(F × id) ⇒ F Σ∗ . For our
sync to be able to model such interleaving, we can replace F by the cofree comonadon it, as is done in [70, Example 3.11]. This extension should not be hard but detailed
treatment is left as future work.
In K(T ): trace equivalence is a congruence
In Chapter 2 we have shown that trace semantics—including trace set semantics fornon-deterministic systems and trace distribution semantics for probabilistic systems—
is also captured by coinduction employed in a Kleisli category K(T ).
Our compositionality result (Theorem 5.2.1) applies to this Kleisli setting all thesame: in presence of a suitable tensor ⊗ in K(T ) and a synchronization naturaltransformation, we can compose coalgebras and trace semantics (via coinduction inK(T )) is automatically compositional.
Recall that, in this setting, systems are modeled as F -coalgebras in K(T ) where
the functor F : K(T ) → K(T ) is a lifting of some F : Sets → Sets. Following thesame spirit, it is possible to reduce the relevant ingredients (namely a tensor ⊗ and5.2

Parallel composition of coalgebras

123

a synchronization, both in K(T )) to certain constructs in Sets. This procedure will
be described later in Section 5.5.

5.2.3

Equational properties of parallel composition operators

Now we shall investigate equational properties—associativity, commutativity, and soon—of an outer parallel composition operator ⊗ and an inner one , which we haveignored deliberately for simplicity of arguments. We present our results in termsof associativity; it is straightforward to transfer the results to other properties like
commutativity.
First we present a result on an outer composition ⊗ (which arises from ⊗ andsync; see Section 5.2.1). The main point is as follows: if ⊗ is associative and sync is“associative,” then the lifting ⊗ is associative. The proof is straightforward.
5.2.4 Theorem. Let C be a category with a strictly associative tensor ⊗,6 and F :C → C be a functor with sync : F X ⊗ F Y → F (X ⊗ Y ). If the diagram
F X ⊗ (F Y ⊗ F Z)
id
(F X ⊗ F Y ) ⊗ F Z

F X ⊗ sync

sync ⊗F Z

F X ⊗ F (Y ⊗ Z)
F (X ⊗ Y ) ⊗ F Z

sync

sync

F (X ⊗ (Y ⊗ Z))
id
F ((X ⊗ Y ) ⊗ Z)
(5.8)

commutes, then the lifted tensor ⊗ on CoalgF is strictly associative.

The two (vertical) identity arrows in (5.8) are available due to strict associativity of⊗. Later in Section 5.4 we shall reveal the generic principle behind the commutativity
condition of (5.8), namely a coherence condition of a lax natural transformation.
Once we have an associative outer composition ⊗ , associativity of an inner composition : Z ⊗ Z → Z is straightforward by coinduction.
5.2.5 Theorem. Assume that Theorem 5.2.4 holds and hence we have a strictly
associative tensor ⊗ on CoalgF . Then the inner composition operator : Z ⊗ Z → Z
induced by coinduction (5.6) is associative in the following sense.
Z ⊗ (Z ⊗ Z)

id

(Z ⊗ Z) ⊗ Z

Z⊗ 
Z ⊗Z



 ⊗Z

Z ⊗Z

Z

The identity arrow in the diagram is due to the strict associativity of ⊗.
CSP

CCS



and sync
in Section 5.2.2 are easily seen to be “asAs an example, syncsociative” in the sense of the diagram (5.8). Therefore the resulting tensors ⊗ arestrictly associative; so are the corresponding inner composition operators .
6 As mentioned already, in the current work we stick to strict algebraic structures.

124

5.3

5

Foundational study: concurrency and the microcosm principle

Formalizing the microcosm principle

In this section we shall formalize the microcosm principle for an arbitrary algebraic
theory presented as a Lawvere theory L. The formalization will be used later in
Section 5.4 where we give a general account of algebraic structures on coalgebras.
In our formalization (which we sketched in Section 5.1) an
1outer model will be a product-preserving functor C : L → CAT;⇓X
an inner model inside will be a lax natural transformation X : L
CATC
1 ⇒ C. Here 1 : L → CAT is the constant functor which maps
everything to the category 1 with one object and one arrow.7 Mediating 2-cells for thelax natural transformation X play a crucial role as inner interpretations of algebraic
operations. In this section we heavily rely on 2-categorical notions, of which detailed
accounts can be found in [19].

5.3.1

Lawvere theories

Lawvere theories are categorical presentations of algebraic theories. The notion is
introduced in [90] (not under this name, though) aiming at a categorical formulationof “theories” and “semantics.” An accessible introduction to the notion can be foundin [82]. Lawvere theories are known to be equivalent to ﬁnitary monads. These two
ways of presenting algebraic theories have been widely used in theoretical computerscience, e.g. for modeling computation with eﬀect [59, 100]. Recent developments(such as [104]) utilize the increased expressive power of enriched Lawvere theories.
In the sequel, by an FP-category we refer to a category with (a choice of) ﬁnite
products. An FP-functor is a functor between FP-categories which preserves ﬁnite
products “on-the-nose,” that is, up-to-equality instead of up-to-isomorphism.
5.3.1 Deﬁnition (The category Nat). By Nat we denote the category of natural
numbers (as sets) and functions between them. Therefore every arrow in Nat is a (cotuple of) coprojection: an arrow f : k → n can be written as a cotuple [κf (1) , . . . , κf (k) ]where κi : 1 → n is the coprojection into the i-th summand of n = 1 + · · · + 1 (ntimes). Dually, every arrow in Natop is a (tuple of) projection.
5.3.2 Deﬁnition (Lawvere theory). A Lawvere theory is a small FP-category L
equipped with an FP-functor H : Natop →L which is bijective on objects. We shalldenote an object of L by a natural number k, identifying k ∈ Natop and Hk ∈ L.
The category Natop —which is a free FP-category on the trivial category 1—isthere in order to specify the choice of ﬁnite products in L. For illustration, we makesome remarks on L’s objects and arrows.
– An object k ∈ L is a k-fold product 1 × · · · × 1 of 1 ∈ L. Note that 1 ∈ L is nota terminal object; instead 0 ∈ L is terminal since 0 is terminal in Natop .
7 The functor 1 : L → CAT is a special case of an outer model of L.

5.3

Formalizing the microcosm principle

125– An algebraic operation appears in L in the form of an arrow. That is, a k-ary
operation as an arrow k → 1 in L; an arrow k → n is then understood as ann-tuple f1 , . . . , fn  of k-ary operations. To be precise, arrows in L also include
πprojections (such as 2 →1 1) and terms made up of operations and projections(such as 3m◦ π1 ,π2 

−→

1).

Conventionally in universal algebra, an algebraic theory is presented by an algebraic
speciﬁcation (Σ, E)—a pair of a set Σ of operations and a set E of equations. A
Lawvere theory L arises from such (Σ, E) as its so-called classifying category (seee.g. [61, 90]). An arrow k → n in the resulting Lawvere theory L is an n-tuple→→→([t1 (−x )], . . . , [tn (−x )]) of Σ-terms with k variables −x , where [ ] denotes taking anequivalence class modulo equations in E. An equivalent way to describe this construction is via sketches: (Σ, E) is identiﬁed with an FP-sketch, which in turn induces
L as a free FP-category. See [11] for details.
5.3.3 Example. Our leading example is the Lawvere theory Mon for monoids.8 It
arises as a classifying category from the well-known algebraic speciﬁcation of monoids.
This speciﬁcation has a nullary operation e and a binary one m; subject to the equations
m(x, e) = x ,m(e, x) = x andm(x, m(y, z)) = m(m(x, y), z) .
em

Equivalently, Mon is the freely generated FP-category by arrows 0 → 1 and 2 → 1
subject to the following commutativity.

1

id, e2

e, id
m

id

1

1

id × mid

3

m × id

2
m

2

m

(5.9)

1

These data (arrows and commutative diagrams) form an FP-sketch (see [11]).

5.3.2

Outer models: L-categories

We start by formalizing an outer model. It is a category with an L-structure, hence
we call it an L-category.
By the way, it is standard that a (set-theoretic) model of L—a set with an LX
structure—is identiﬁed with an FP-functor L → Sets. Concretely, let X = X1 be
the image of 1 ∈ L; this is the carrier set. Then k ∈ L must be sent to X k = X×· · ·×X(k times) due to preservation of ﬁnite products. Now the functor’s action on arrows
8 The Lawvere theory Mon for the theory of monoids should not be confused with the categoryof (set-theoretic) monoids and monoid homomorphisms (which is often denoted by Mon as well).

126

5

Foundational study: concurrency and the microcosm principle

is what interprets L’s operations in X.
L
2
m
1

X

−→
−→

Sets
X2
m
X

Equations (expressed as commutative diagrams in L) are satisﬁed because a functor
preserves commutative diagrams.
Turning back to L-categories, what we have to do now is to just replace Sets by
the category CAT of (possibly large but locally small) categories.
C

5.3.4 Deﬁnition (L-categories). A (strict) L-category is an FP-functor L → CAT.
In the sequel we denote the image C1 of 1 ∈ L by C; and the image Ca of an arrow a
by a.
A morphism of L-categories—formalized as follows—is understood as a functor
which preserves an L-structure.
5.3.5 Deﬁnition (L-functors). Let C and D be L-categories. An L-functor F : C →D is a natural transformation L

C
⇓F

CAT .

D

Indeed, the 1-component of such a natural transformation is a functor F1 : C → D;
this is the “underlying” functor.
Another way to look at the previous deﬁnitions is to view an L-structure as “factorization through Natop → L.” Speciﬁcally, we can identify a category C ∈ CAT witha functor 1 → CAT, which is in turn identiﬁed with an FP-functor Natop → CAT,
because Natop is the free FP-category on 1.
C, a category
C : 1 −→ CAT, a functor
C : Natop −→ CAT,an FP-functor

We say that C has an L-structure, if the last FP-functor C : Natop → CAT factors
through H : Natop → L.
H
L
Natop
C

CAT

Note that the factorization is not necessarily unique, because there can be diﬀerent
ways of interpreting the algebraic theory L in C.
F
This factorization view applies also to L-functors. A functor C → D is identiﬁed
with a natural transformation 1 ⇓F CAT ; and then with Natop ⇓F CAT
due to the 2-universality of Natop as a free object. We say that this F preserves

5.3

Formalizing the microcosm principle

an L-structure, if the natural transformation NatopH : Natop → L.
H

Natop

⇓F

127

CAT factors through

L

⇐

⇓

F

CAT

5.3.6 Example. The usual notion of strictly monoidal categories coincides with Lcategories for L = Mon. A tensor ⊗ and a unit I on a category arise as interpretationmeof the operations 2 → 1 and 0 → 1; commuting diagrams in Mon such as m ◦ id, e =id yield equational properties of ⊗ and I.

5.3.3

Remarks on “pseudo” algebraic structures

As we mentioned already, in the current work we focus on strict algebraic structures. This means that monoidal categories (in which associativity holds only upto-isomorphism, for example) fall out of our consideration. Extending our current
framework to such “pseudo” algebraic structures is one important direction of our future work. Such an extension is not entirely obvious; we shall sketch some preliminary
observations in this direction.
The starting point is to relax the deﬁnition of L-categories from (strict) functors
L → CAT to pseudo functors, meaning that composition and identities are preservedC
only up-to-isomorphism. Then it is not hard to see that a pseudo functor Mon →CAT (which preserves ﬁnite products in a suitable sense) gives rise to a monoidal
category.
C
Let us take a detailed look. A pseudo functor Mon → CAT preserves composition
up-to-isomorphism; let us denote the mediating natural isomorphism by Cb,a as below.
in Monin CAT

j
a

a

Cj
Cb,a
=⇒
∼
=

k

Ck

b
n

b Cnb ◦ a(5.10)

Then a commuting diagram in Mon (below left) gives rise to the two iso-2-cells on
the right.
in CATin Mon3
id×m

id×m
m×id

2

2

m

C2

Cm,id×m⇒

C3

m×id

m◦(m×id)

Cm,m×id⇐=m◦(id×m)

C2

m

1

m

C

m

The composite m ◦ id × m on the left edge is a functor such that
(X1 , X2 , X3 )−→X1 ⊗ (X2 ⊗ X3 ) ;(5.11)

128

5

Foundational study: concurrency and the microcosm principle

the one m ◦ m × id on the right edge is such that
(X1 , X2 , X3 )−→(X1 ⊗ X2 ) ⊗ X3 .

Now the composite C−1
m,m×id • Cm,id×m of the iso-2-cells is what gives us a natural∼=(X1 ⊗ X2 ) ⊗ X3 .
isomorphism α : X1 ⊗ (X2 ⊗ X3 ) →Moreover, the coherence condition on such isomorphisms in a monoidal category(see [14, 96]) requires that “any two compositions of such natural isomorphisms are
identical.” A well-known instance is commutativity of the following “pentagon diagram.”α(X1 ⊗ X2 ) ⊗ (X3 ⊗ X4 )X1 ⊗ (X2 ⊗ (X3 ⊗ X4 ))X1 ⊗ ααX1 ⊗ ((X2 ⊗ X3 ) ⊗ X4 )α
(X1 ⊗ (X2 ⊗ X3 )) ⊗ X4((X1 ⊗ X2 ) ⊗ X3 ) ⊗ X4
α ⊗ X4
Indeed, commutativity of this pentagon is derived from the fact that the following
two composed iso-2-cells are identical.
1·2,3,4

C4C×α1·2,3

1·2,3,4

C3

1·2,3

C2

1,2,3·4

id⇓1,2,3·4

α×C

C4

C3

C2

1,2·3α⇓⇓1,2·3

⇓C3

1·2,3⇓

1,2·3,4

C3

α

1·2

1·2,3α⇓1,2·3

C3
1,2·3

C2

1·2

C

C2

C2

1·2

1·2
1·2

C

These two composites are identical due to the coherence condition on the mediating 2cells Cb,a of a pseudo functor (see [19]). Here the notation 1· 2, 3, 4—with its intention
being x1 , x2 , x3 , x4 # x1 · x2 , x3 , x4 following the categorical logic tradition—denotes
the arrow m ◦ π1 , π2 , π3 , π4  : 4 → 3 in Mon.
So far so good. However, at this moment it is not clear what is a canonicalconstruction the other way round, i.e. from a monoidal category to a pseudo functor.9
In the present paper we side-step these 2-categorical subtleties by restricting ourselves
to strict, non-pseudo algebraic structures.

5.3.4

Inner models: L-objects

We proceed to formalize an inner model. It is an object in an L-category which itself
carries an (inner) L-structure, hence is called an L-object. A monoid object in a
9 For example, given a monoidal category C, we need to deﬁne a functor m ◦ (m × id) = m ◦(id × m) in (5.11). It’s not clear whether it should carry (X, Y, Z) to X ⊗ (Y ⊗ Z), or to (X ⊗ Y ) ⊗ Z.

5.3

Formalizing the microcosm principle

129

monoidal category is a prototypical example. We ﬁrst present an abstract deﬁnition;some illustration follows afterwards.
5.3.7 Deﬁnition (L-objects). An L-object X in an L-category C is a lax naturaltransformation X : 1 ⇒ C (below left) which is “product-preserving”: this means thatthe composition X ◦ H (below right) is strictly, non-lax natural. Here 1 : L → CAT
denotes the constant functor to the trivial one-object category 1.

L

1
⇓X
C

CAT

H

Natop

L

1
⇓X
C

CAT

Such a nested algebraic structure—formalized as an L-object in an L-category—shallbe called a microcosm model for L.
Let us now illustrate the deﬁnition. First, X’s component at 1 ∈ L is a functor
1 → C, which is identiﬁed with an object X ∈ C. This is the carrier object of this innerX
algebra. Moreover, any component 1 →k Ck must be the k-tuple (X, . . . , X) ∈ Ck
of X’s. This is because X is “product-preserving”: for any i ∈ [1, k] we have thefollowing naturality diagram of X ◦ H which requires the composite πi ◦ Xk to be
X1 = X.
X1

in Natopin CAT

k

1

Xk

Ck

Hπi =πi

=

πi

1

1

X1 =X

C

The (inner) algebraic structure on the object X arises in the form of mediating 2-cells
aof the lax natural transformation X. For each arrow k → n in L, lax naturality of X
requires existence of a mediating 2-cell Xa : a ◦ Xk ⇒ Xn . The following diagramshows the situation when we set a = m, a binary operation.
in L

in CAT

2

1

1

⇓

m

X2 =(X,X)

1

Xm

X

C2

(5.12)m=⊗C
μThe natural transformation Xm can be identiﬁed with an arrow X ⊗ X → X in C,
which gives an inner binary operation on the carrier X.
How do such inner operations on X satisfy equations as speciﬁed in L? The key
is the coherence condition10 on mediating 2-cells: it requires Xid = id concerning
identities; and Xb◦a = Xb • (b ◦ Xa ) concerning composition (as in the following
10 This is part of the notion of lax natural transformations; see [19].

130

5

Foundational study: concurrency and the microcosm principle

diagram).
Cl

1

Cl

1

a

⇓

=

⇓

b◦a

⇓

Xb◦a

Cn

1

Xa

1

Xb

1

(5.13)

Ck

b
n

C

The following example illustrates how such coherence induces equational properties.
5.3.8 Example. A monoid object in a strictly monoidal category is an example ofan L-object in an L-category. Here we take L = Mon, the theory of monoids.
μ
For illustration, let us here derive associativity of (inner) multiplication X ⊗ X →X. In the current setting a tensor ⊗ is identiﬁed with m = Cm : C2 → C; the innermultiplication μ is identiﬁed with a mediating 2-cell Xm as in (5.12) above. Now thecoherence condition (5.13) yields the two equalities (∗) below.
in Mon
3

m

m

C

1

⇓

Xm

1

1

m

C

Xm◦(id×m)=Xm◦(m×id)

=

C1

1

C3

1
(∗)

1

Xm×id m×id
2

C

⇓

2

C3

1

Xid×m id×m (∗)
=
2

⇓

2

C3

⇓

m×id

⇓

id×m

in CAT
1

Xm

1

m

C
(5.14)

Now it is not hard to see that: the composed 2-cell on the left
C3

1

Xid×m id×m
2

⇓

1

C

⇓

1

Xm

corresponds toX⊗μμ

X ⊗ X ⊗ X −→ X ⊗ X −→ X ;(5.15)m

Cand the one on the rightC3

1

Xm×id m×id
2

⇓

1

C

⇓

1

Xm

μ⊗X

μ

corresponds to X ⊗ X ⊗ X −→ X ⊗ X −→ X .

mCTherefore the equalities in (5.14) prove associativity of the inner multiplication μ :X ⊗ X → X.
μ⊗X
X ⊗X ⊗X
X ⊗X
μ
X ⊗μ
X ⊗X

μ

X

5.3

Formalizing the microcosm principle

131

For further illustration, let us elaborate the correspondence (5.15). The only nontrivial step in the correspondence is showing
Xid×m = idX , Xm  ,(5.16)

that is, the (upper) 2-cell Xid×m in (5.15) is identical to the tuple idX , Xm  (depicted
X×μbelow) which obviously corresponds to the arrow X ⊗ X ⊗ X −→ X ⊗ X in C.
(X,X,X)

C3⇓ idX ,Xm 1/

id×m=idC ×⊗

C2

that is,

C , 1

⇓idX

1

⇓Xm

X

(X,X)

0

X⊗X

X

C

X

The equality Xid×m = idX , Xm  (5.16) holds essentially because the lax naturaltransformation X is “product-preserving” (Deﬁnition 5.3.7). Product-preservationin this context means that a mediating 2-cell Xπi for a projection πi is an identity.
Indeed, the following calculation shows that π2 ◦ Xid×m = Xm .
C3

1

(X,X,X)= 1

Xid×m id×m
(X,X) C2

C

1

Xπ2
(X,X)

C

1

Xm

X

C

2

X

1
(∗)

= 1

m

C

(X,X,X)

C3

id
(X,X)

π2 =π2

C

⇓

⇓

1

C3

π2 =π2π2 =π2

C

⇓

⇓

= 1

Xπ2 ◦(id×m)=Xm◦π2(X,X,X)

Xπ2

1

⇓
(†)

= 1

C

X

1

C3

(†)

=

id

C3

Xid×m id×m
(X,X) C2(∗)

π2 =π2⇓π2 =π2(X,X,X)

⇓

C2

1

1

⇓

id×m

C3

⇓

⇓

Xid×m

1

1

1

Xm

X

2

= Xm

m

C

Here (∗) holds since Xπi = id; (†) refers to the coherence condition (5.13) on mediating
2-cells on X. Similar calculation shows π1 ◦ (Xid×m ) = idX ; this proves the equality
Xid×m = idX , Xm  in (5.16).

5.3.5

Basic observations on microcosm models

We shall establish some basic facts about microcosm models. Some of them will be
used later in our main result of general compositionality (but many others will not).
Lifting outer L-structures
Let C be an L-category, and F : C → C be a functor. Later in Section 5.4 we wantto lift the L-structure on C to the one on the category CoalgF of F -coalgebras. We
can imagine that, for us to be able to do so, the functor F needs to be somehow
compatible with L. It turns out that F ’s being a lax L-functor is suﬃcient. It is
weaker than F ’s being an L-functor (Deﬁnition 5.3.5).

132

5

Foundational study: concurrency and the microcosm principle

5.3.9 Deﬁnition (Lax L-functors). A functor F : C → D between L-categories issaid to be a lax L-functor if it is identiﬁed with11 some lax natural transformation
LC⇓F

CAT which is product-preserving (meaning F ◦ H is strictly natural; seeDDeﬁnition 5.3.7).
Lax naturality means that, for each arrow a : k → n in L, we have the following
mediating 2-cell. We shall denote it by Fa .
in L

in CATan

Fk = F k
⇓

Ck
a
Cn

k

Fa
Fn = F n

Dk
a
Dn

(5.17)

Here the k-component Fk of the lax natural transformation F is identical toF k : Ck −→ Ck ,(X1 , . . . , Xk ) −→ (F X1 , . . . , F Xk ) ,(5.18)

because F is “product-preserving”: for each i ∈ [1, k] we have the following (non-lax)
naturality diagram.
in Natopin CAT

k

Ck

1

=

πi  = πi
C

πi

Fk

F1 = FDk
πi  = πiD

Dually, an oplax L-functor is a functor F : C → D which can be identiﬁed with
an oplax natural transformation L

C⇓F

CAT which is “product-preserving.” ItsD

mediating 2-cells—as in (5.17), but in the opposite direction—shall be denoted by Fa
as well.
5.3.10 Proposition.
1. Let C be an L-category and F : C → C be a lax L-functor.
U
Then CoalgF is an L-category; moreover the forgetful functor CoalgF → C isa (strict, non-lax) L-functor.
2. Dually, if F : C → C is an oplax L-functor, then the category AlgF of F algebras is an L-category. Moreover the forgetful functor AlgF → C is an
L-functor.
3. Given a microcosm model X ∈ C for L, the slice category C/X is an L-category;dommoreover the functor C/X −→ C is an L-functor.



These results can be derived from a more general result (Lemma 5.3.12) concerning
inserters. The notion of inserters can be deﬁned in any 2-category; here for simplicity
we focus on inserters in the speciﬁc 2-category CAT.
11 Meaning: F : C → D is the 1-component of such a lax natural transformation C ⇒ D.

5.3

Formalizing the microcosm principle

133

5.3.11 Deﬁnition (Inserters). Let F, G : C ⇒ D be two functors with the same
domain and codomain. An inserter Ins(F, G) for F and G consists of– a category Ins(F, G);R– a functor Ins(F, G) → C; and– a natural transformation ρ : F R ⇒ GR (below left) which is universal: each
triple (B, B, β) such as below right
R

C
C

R

B

F
D

ρ

B

G

C
⇓

⇓

Ins(F, G)

C

B

F
D

β
G

induces a unique mediating functor B : B → Ins(F, G) such that B = R ◦ B
and β = ρ ◦ B.
B

B

⇓β

B

Ins(F, G)

C

F

R

D

B

⇓ρ
R

C

G

By the universality it is obvious that an inserter, if it exists, is unique up-to-isomorphism.
This 2-categorical notion of inserters comes from [74, 131]; see also [54]. Examples
include slice categories, categories of algebras and of coalgebras:
id

!

F

id

X

C/X = Ins( C → C , C → 1 → C ) ,id

AlgF = Ins( C → C , C → C ) ,F

CoalgF = Ins( C → C , C → C ) .

These description of the three categories as inserters allows us to instantiate thefollowing lemma to Proposition 5.3.10.
5.3.12 Lemma. Let C and D be L-categories, and F, G : C ⇒ D be two functors. If
F is an oplax L-functor and G is a lax L-functor, then the inserter Ins(F, G) is anR
L-category. Moreover the functor Ins(F, G) → C is an L-functor; in this sense theL-structure on Ins(F, G) is a lifting of the one on C.
aa

Proof. We have to deﬁne, for each arrow k → n in L, its interpretation Ins(F, G)k →Ins(F, G)n . Note here that the codomain itself is an inserter:
Ins(F, G)n

∼
=

Fn

Gn

Ins( Cn → Cn , Cn → Cn ) .

134

5

Foundational study: concurrency and the microcosm principle
a

We obtain such an interpretation Ins(F, G)k → Ins(F n , Gn ) by the following 2-cell,
via universality of the inserter Ins(F n , Gn ).

F

k

⇓

ρk

aC

Rk

Ck

Gk
aC

Cn
Fn
Fa
aD
Dk
Ga
Gn
Cn

⇓

Ins(F, G)k

Ck

Dn

⇓

Rk

Here the 2-cell ρ is the one accompanying Ins(F, G); Fa comes from oplax naturalityof F ; and Ga comes from lax naturality of G.
Functoriality of the operation Ins(F, G) : L → CAT thus induced follows fromR
universality of inserters. Moreover, L-functoriality of Ins(F, G) → C (i.e. naturality
Rof Ins(F, G) ⇒ C : L → CAT) holds because a arises as a “mediating” functor. 
Facts on L-objects
5.3.13 Proposition.
L-functor.

1. A lax L-functor preserves L-objects. Hence so does an

2. A ﬁnal object of an L-category C, if it exists, is an L-object. The inner Lstructure is induced by ﬁnality.
Proof. 1. A vertical composition of lax natural transformations is again a lax naturaltransformation. Hence the following vertical composition gives rise to an L-object
F X in an L-category D.
1
⇓ X
CAT
L
C
⇓ F
D


2. Straightforward.

When we ﬁx an L-category C, the notion of morphisms between L-objects in C isformalized as suitable modiﬁcations (see [19]).
5.3.14 Deﬁnition (Morphisms of L-objects). Let C be an L-category, and X, Y be
L-objects in C. A morphism f from X to Y is a modiﬁcation of the following type.

L

1
f
X⇓⇓Y
C

CAT

L-objects in C and morphisms between them form a category; we shall denote it byL-objC .

5.3

Formalizing the microcosm principle

135

Let us spell out the deﬁnition. Such a modiﬁcation f consists of 2-cells fk : Xk ⇒ Yk
in CAT, for each k ∈ L, from X’s k-component to Y ’s.
Xk = (X, . . . , X)
⇓ fk

1

Ck

Yk = (Y, . . . , Y )Additionally, these components fk of f are required to be compatible with lax naturality of X and Y , in the following sense.
in CAT
k

Xk
C
Xa
a
Xn
n
⇓ fn C
Yn

1

a

1
=

Xk
⇓ fk Ck
Yk
a
Ya
n
C
Yn

(5.19)

⇓

1

n

k

⇓

in L

1

A special case is when an arrow a is a projection πi : k → 1; in this case the mediating
2-cells Xπi and Yπi are in fact identities because X and Y are product-preserving(Deﬁnition 5.3.7). The equality (5.19) in this special case proves that each component
fk of f is identiﬁed with a tuple(X, . . . , X)

fk = (f, . . . , f )(Y, . . . , Y )in Ck ,

where we identify f ’s 1-component with an arrow f : X → Y in C.
When the arrow a in (5.19) is thought of as an algebraic operation, the equality
requires that the arrow f : X → Y in C should be compatible with the inner interpretations Xa and Ya of a. For illustration let us take a = m : 2 → 1, a binary operation.
μX

f

The 2-cell on the left in (5.19) corresponds to the arrow X ⊗ X → X → Y ; the one
μY

f ⊗f

on the right corresponds to X ⊗ X → Y ⊗ Y → Y . Therefore the equality in (5.19)
instantiates to the following oft-seen diagram for a “morphism of algebras.”
X ⊗X
μX
X

f ⊗f

f

Y ⊗Y
μY
Y

This diagram as an instance of (5.19) justiﬁes Deﬁnition 5.3.14 of morphisms of Lobjects, that is, morphisms of (inner) L-algebras.
It is standard that a limit lim(J → Sets) in Sets is presented as the set of“coherent elements” [96, Theorem V.1.1]; this is essentially due to the isomorphism
S ∼= Sets(1, S). Similar arguments, but using C ∼= CAT(1, C) instead, lead to thefollowing result. Its proof is straightforward.

136

5

Foundational study: concurrency and the microcosm principle

5.3.15 Proposition. The category L-objC is a lax FP-limit of the diagram C : L →CAT. That is, the canonical cone from L-objC over C : L → CAT is universal
among the lax cones over C : L → CAT

L

ΔB
⇓β
C

CAT

which are product-preserving (meaning β ◦ H is strictly natural; see Deﬁnition 5.3.7).


5.4

Microcosm structures in coalgebras

In this section we return to our original question and apply the framework we justintroduced to coalgebraic settings. We present our main result in this chapter (Theorem 5.4.2), which generalizes the previous compositionality result (Theorem 5.2.1).
Here the constructs in Section 5.2 (such as sync) will appear again, now in theirgeneralized form.
Lax L-functors generalize sync
In Section 5.2 we observed that an endofunctor F with sync : F X ⊗ F Y → F (X ⊗ Y )allows a lifting of an ⊗-structure on C to an ⊗ -structure on CoalgF . In the current
generalized setting where we consider an arbitrary algebraic theory L, what corresponds to this endofunctor F with sync is a lax L-endofunctor F (Deﬁnition 5.3.9).
To illustrate this, look at the following lax naturality diagram for a binary operation
m in L = Mon.
in Mon2⇓

m
1

in CAT C2 F2 = F × F C2
m = ⊗
m = ⊗Fm
C
C
F

(5.20)The 2-component is F2 = F × F because the lax natural transformation F is productpreserving; see (5.18). The mediating 2-cell Fm in (5.20) is identiﬁed with a naturaltransformation
F X ⊗ F Y −→ F (X ⊗ Y ) ;this is what we previously called sync.
5.4.1 Remark. Moreover, Fm (identiﬁed with sync) becomes automatically compatible with equational properties such as associativity, in the sense of (5.8). This isbecause of the coherence condition (just like (5.13)) on F ’s mediating 2-cells. For5.4

Microcosm structures in coalgebras

137

example, using coherence we have the following equalities much like in (5.14).
in CAT

3

C3
2
m

1

m

C

C2

Fm

F

=

C

C3

C3
=

Fm◦(id×m)=Fm◦(m×id)

C

C

1

F ×F ×F

C

2

1

C3

Fm×id

m×id

C

⇓

m

C2

C3
⇓

2

id×m

⇓

m×id

C3

Fid×m

⇓

id×m

F ×F ×F⇓

in Mon

C

Fm

F

2
m

C
(5.21)

The composed 2-cell on the left corresponds to a natural transformation
F X ⊗ (F Y ⊗ F Z)

F X⊗sync−→sync

F X ⊗ F (Y ⊗ Z) −→ F (X ⊗ (Y ⊗ Z)) ;the one on the right corresponds to(F X ⊗ F Y ) ⊗ F Z

sync ⊗F Z

−→

sync

F (X ⊗ Y ) ⊗ F Z −→ F ((X ⊗ Y ) ⊗ Z) .

Hence the equalities above in (5.21) prove: if F is a lax Mon-functor, then its sync
(identiﬁed with the 2-cell Fm ) is automatically “associative” in the sense of (5.8).
General compositionality
Among the ingredients for the previous compositionality result (Theorem 5.2.1), an
endofunctor F with sync has now been generalized to a lax L-functor F . The otheringredient—the base category C with a tensor ⊗—has an immediate generalization
as an L-category C. These generalized notions constitute an appropriate setting forthe following main result of this chapter.
5.4.2 Theorem (General compositionality). Let C be an L-category and F : C → C∼=
F Z is the ﬁnal coalgebra. Then:be a lax L-functor. Assume further that ζ : Z →1. The category CoalgF of F -coalgebras is an L-category.
2. So is the slice category C/Z.
3. The functor beh : CoalgF → C/Z is a (non-lax) L-functor. It makes thefollowing diagram of L-functors commute.
beh

CoalgF
U

C

C/Z
dom

Proof. 1. This is the same as Proposition 5.3.10.1.
2. ζ ∈ CoalgF is an L-object (Proposition 5.3.13.2); so is Z = U ζ (Propositions 5.3.13.1 and 5.3.10.1); hence C/Z is an L-category (Proposition 5.3.10.2).
3. Straightforward by ﬁnality.


138

5

Foundational study: concurrency and the microcosm principle

In fact, the theorem also generalizes our previous result (Theorem 5.2.4) stating:if sync is “associative,” then ⊗ on CoalgF is associative. Indeed, the statementof the above Theorem 5.4.2.1—CoalgF being an L-category—means, not only that
operations are interpreted in CoalgF , but also that all the equational properties speciﬁed in L are satisﬁed in CoalgF . The assumption in the previous Theorem 5.2.4—
associativity of sync—is present in the generalized Theorem 5.4.2, in the form of F ’s
being a lax L-functor (see Remark 5.4.1).
We describe concretely what are the lifted algebraic structures on CoalgF andon C/X in Proposition 5.3.10; such a concrete description is helpful in seeing that
Theorem 5.4.2.3 indeed implies coalgebraic compositionality expressed as the equation (5.4). An operation a : k → 1 in L is interpreted in CoalgF and C/X as follows,
respectively, using Fa from lax naturality of F and the inner algebraic structure Xa
on X.
→
−
F a( X )−(Fa )→
 F X1F Xk 
X−−→
c1 , . . . ,ck
aCoalgF :,−→ a(F X)
→
−
X1
Xk
a( c )→−a( X )→−a( Y )
→
 Y1
Yk 
a(−
y)
→
−
y1 , . . . , yk
aC/X :−→ a( X )
.
X
X
Xa
X
These generalize the lifted binary operations ⊗ on CoalgF (5.5) and ⊗ on C/Z (5.7).
Note the use of Fa (in place of sync) and Xa (in place of ).

5.5

Parallel composition of coalgebras in K(T )Our main results—Theorem 5.2.1 and generalized Theorem 5.4.2—apply to our coalgebraic framework for trace semantics (Chapter 2) as well. In this case we takea suitable Kleisli category as the base category C; coinduction now captures trace
semantics (as opposed to bisimilarity captured in C = Sets).
In this section we shall describe some speciﬁc issues regarding this Kleisli setting.
In Section 5.5.1 the ingredients for our parallel composition framework, namely:– an algebraic structure ⊗ on the base category C = K(T ), and– a synchronization natural transformation which lifts ⊗ on the base category to⊗ on coalgebras,
are reduced to certain constructs in Sets. In Section 5.5.2 we further investigate therelationship between parallel composition and forward/backward simulations (Chapter 3).

5.5

5.5.1

Parallel composition of coalgebras in K(T )139

Trace equivalence is a congruence

The following is the relevant setting from Chapter 2. The functor F on Sets is lifted to
F on K(T ) with the help of a distributive law λ : F T ⇒ T F . Systems are presented
as F -coalgebras (in K(T )) and coinduction there yields trace semantics.
CoalgF
T

K(T )F

Sets

F

We shall show that, when we apply the parallel composition framework (Theorem 5.2.1)
to this Kleisli setting, we can reduce the ingredients in K(T )—namely F , ⊗ andsync—to the following constructs in Sets.
F : K(T ) → K(T )to F : Sets → Sets and λ : F T ⇒ T F ;⊗ on K(T )to (× on Sets, and) ξ : T X × T Y → T (X × Y );sync : F X ⊗ F Y → F (X ⊗ Y ) in K(T )to sync : F X × F Y → F (X × Y ) in Sets, compatible with λ and ξ.
The ﬁrst item (reduction of F to F and λ) is already described in Section 2.2.
We obtain a tensor ⊗ on K(T ) as a lifting of Cartesian products × on Sets. Sucha lifting is available when the monad T comes with a natural transformation
ξX,Y : T X × T Y → T (X × Y )which is compatible with the monad structure in the obvious way:
X ×Y

η×η
η

T 2X × T 2Y

TX × TYξ

T (T X × T Y )Tξ

T 2 (X × Y )
μ

μ×μ

ξ

TX × TY

T (X × Y )ξ

(5.22)T (X × Y ) .

The lifted tensor⊗ : K(T ) × K(T ) −→ K(T )acts as products on objects: X ⊗ Y = X × Y . Its action on arrows is deﬁned asfollows, using the natural transformation ξ.
f ⊗g

X ⊗ Y −→ V ⊗ W
f ×g

ξV,W

X × Y −→ T V × T W −→ T (V × W )in K(T )(5.23)

in Sets

The natural transformation ξ’s compatibility with η and μ (5.22) is needed to ensurethat the lifted ⊗ is a bifunctor.

140

5

Foundational study: concurrency and the microcosm principle

The monads L, P and D of our interest—which specify types of branching, see
Chapter 2—are equipped with such ξ. Indeed, those monads are commutative andtheir double strength dst (2.13) serves as ξ. Consequently the Kleisli category K(T )for T ∈ {L, P, D} has a tensor ⊗ which arises in the way described above.
In order to further lift this tensor ⊗ on K(T ) to parallel composition operator ⊗on CoalgF (Theorem 5.2.1), we need a synchronizationsync : F X ⊗ F Y −→ F (X ⊗ Y )in K(T ).

This sync in K(T ) can be obtained as a lifting of sync in Sets, in case the latter issuitably compatible with λ and ξ.
5.5.1 Proposition. Assume the following.
– F is an endofunctor on Sets equipped with a natural transformation
syncX,Y : F X × F Y −→ F (X × Y ) ;– T is a monad on Sets with a natural transformation
ξX,Y : T X × T Y −→ T (X × Y )satisfying the compatibility condition (5.22); and– we have a distributive law λ : F T ⇒ T F relating them.
Assume further that the natural transformations sync, ξ and λ make the following
diagram commute.
FTX ⊗ FTYλ⊗λ
TFX ⊗ TFY

sync

F (T X ⊗ T Y )T (F X ⊗ F Y )ξFξT syncF T (X ⊗ Y )λT F (X ⊗ Y )(5.24)

If this is the case, then
syncX,Y := η ◦ syncX,Y:F X ⊗ F Y −→ F (X ⊗ Y )in K(T )is indeed a natural transformation.
Consequently, the category K(T ) with the tensor ⊗ (induced by ξ) and the endofunctor F with sync thus obtained satisfy the assumptions of Theorem 5.2.1. This
ensures that behavior by coinduction (giving trace semantics) satisﬁes compositionality (5.4).

5.5

Parallel composition of coalgebras in K(T )141

Proof. We shall show the naturality of sync = η ◦ syncX,Y . Let f : X → V andg : Y → W be arrows in K(T ).
F (f ⊗K(T ) g) ◦K(T ) syncX,Y= μ ◦ T (F (f ⊗K(T ) g)) ◦ sync
= μ ◦ T λ ◦ T F (f ⊗K(T ) g) ◦ η ◦ sync
= μ ◦ T λ ◦ T F ξ ◦ T F (f × g) ◦ η ◦ sync

by def. of ⊗K(T )= μ ◦ η ◦ λ ◦ F ξ ◦ F (f × g) ◦ sync

naturality of η

= λ ◦ F ξ ◦ sync ◦ (F f × F g)unit law, naturality of sync

= T sync ◦ ξ ◦ (λ × λ) ◦ (F f × F g)assumption= μ ◦ T η ◦ T sync ◦ ξ ◦ (λ × λ) ◦ (F f × F g)unit law= sync ◦K(T ) (F f ⊗K(T ) F g) .



5.5.2 Example. To look at more concrete examples, let us take the powerset monad
T = P modeling non-deterministic branching, and F = {} + Σ × modeling thetransition-type “terminate, or output and continue.” This is the leading example in
Chapter 2. An F -coalgebra X → F X in K(P) is an LTS with explicit termination;by coinduction it is assigned a map X → P(Σ∗ ) in Sets which gives the terminating
sequences of actions. For this choice of F , one possible choice of sync : F X × F Y →F (X × Y ) is as follows.
sync :({} + Σ× X) × ({}+ Σ × Y )(a, x) , (a, y)(u, v)−→−→−→{} + Σ × (X × Y )(a, (x, y)),otherwise.
(5.25)

We can easily check that this sync is compatible with the canonical ξ and λ in thesense of (5.24). Therefore this sync on Sets lifts to sync on K(P) and Theorem 5.2.1
applies. We conclude that trace equivalence (captured by coinduction) is a congruencewith respect to the parallel composition obtained from this sync.
5.5.3 Example. When we replace T = P in the previous Example 5.5.2 by thesubdistribution monad D, the systems have probabilistic branching and coinduction
captures trace distribution semantics. The sync in (5.25) is well-behaved in this casetoo; it is lifted to sync on K(D) and by Theorem 5.2.1 we conclude that the equivalence modulo trace distribution semantics is a congruence.
Generalization to an arbitrary L
We have described how we can obtain a parallel composition framework in K(T )from suitable constructs in Sets. We have focused on a simple setting where we only
consider one binary operation (for parallel composition) and no equational properties. Let us generalize our observation to an arbitrary algebraic theory L. A generalprinciple which yields the compatibility condition (5.24) will be revealed in its course.

142

5

Foundational study: concurrency and the microcosm principle
1. Let C be an L-category, and T : C → C be a monad such

5.5.4 Proposition.
that:– its functor part is a lax L-functor; and– the mediating 2-cells Ta (of T as a lax L-functor) are compatible with themonad structure in an obvious way. Namely, for each arrow a : k → n in
L,
id

id

⇓η k

·

Tk
Ta

a

·
a

·

⇓η n

= a

·

⇓

·

=

·

·

·

·
a

·

Tn

Ta

Tn

·

Tk

a T

a

·

⇓μn

·

⇓

a

Ta

=

⇓

⇓

·

·

Tk

Tk
k

Tk

a

·

Tn

⇓μ

·

a

id

Tn
Tk

·

a

Tn

·

Tn

Then the Kleisli category K(T ) is an L-category; moreover the canonical Kleisli
inclusion C → K(T ) is an L-functor.
2. Assume further that we have a lax L-functor F : C → C and a distributive law
λ : F T ⇒ T F , which are altogether compatible in the following sense. For eacharrow a : k → n in L,
Tk

Tk
Ta

Fa

Fn

·

⇓

⇓

·

·

⇓λk

Tn

Tk

·

·
a

·

=

a

·

·

Fn

Fa

Ta

Tn

Fk

·

⇓λn

·

·

⇓

a

Fk

Fk

⇓

·

·

Fn

a

(5.26)·

Tn

Then the lifted functor F : K(T ) → K(T ) is a lax L-functor. If moreover there
is a ﬁnal F -coalgebra (which is the case in the setting of Chapter 2), the generalcompositionality result (Theorem 5.4.2) applies to F -coalgebras.
This proposition (whose proof is straightforward) generalizes the previous observations. Speciﬁcally, a monad T which satisﬁes the assumption of Proposition 5.5.4.1
replaces a monad T with a natural transformation ξ : T X ⊗ T Y → T (X ⊗ Y ); the resulting L-structure on K(T ) replaces the previous ⊗ on K(T ). The condition (5.26)
can be thought of as a “coherence condition on a modiﬁcation λ : F T  T F between
lax natural transformations” (see e.g. [19]); it instantiates to the previous condition (5.24).

5.5

5.5.2

Parallel composition of coalgebras in K(T )143

Simulations are compositional

Let us continue our investigation and look at the relationship between parallel composition and forward/backward simulations. Our principal result here is: forward/backward
similarity relations F and B (Deﬁnitions 3.2.8 and 3.2.9) are compositional, that
is,
⎞
⎛
⎞
⎛
FX
FY
FX
FV
FY
FV
⊗ e ⎠ F ⎝ d⊗ e ⎠ .
(5.27)
F d=⇒ ⎝ c
c
X
Y
X
V
Y
V
A suﬃcient condition for this compositionality is described as a simple order-theoretic
property of the tensor ⊗ on K(T ). This condition can be further reduced to a propertyof ξ, a natural transformation which lifts × on Sets to ⊗ on K(T ) (Section 5.5.1).
The above compositionality (5.27) is concerned with the forward similarity F ;similar results hold also for the backward similarity relation B and the backwardforward one BF . The compositionality (5.27) also focuses on the ﬁrst argument of
the operator ⊗ ; compositionality with respect to the second argument is proved in
the same way as well.
Throughout this section we ignore explicit start state maps which, together with
F -coalgebras, formed (T, F )-systems in Chapter 3. We do so for simplicity of presentation; incorporating start state maps again can be done in a straightforward way.
5.5.5 Proposition. Let (F, T, λ) be a trace situation (Theorem 2.3.3). Assume further that– the Kleisli category K(T ) has a tensor ⊗; and– the lifted functor F : K(T ) → K(T ) comes with a natural transformationsync : F X ⊗ F Y → F (X ⊗ Y ),so that we have a parallel composition operator ⊗ for F -coalgebras (Theorem 5.2.1).
If the tensor⊗ : K(T ) × K(T ) −→ K(T )is locally monotone, then the similarity relations F , B and BF are compositional
as in (5.27).
Proof. Local monotonicity of ⊗ on K(T ) means:in K(T ) X
f  f
V

X ⊗Y

Y
,

g  gW=⇒f ⊗ g  f  ⊗ g .
V ⊗W

Let us focus on the compositionality (5.27), that is, compositionality of F withrespect to the ﬁrst argument. By assumption we have a forward simulation f from c

144

5

Foundational study: concurrency and the microcosm principle

to d.
in K(T )

Ff
FY
d
Y

f

FX
c
X

By local monotonicity of ⊗, this yields the lower inequality in the following diagram.
The upper square commutes by naturality of sync; the whole diagram stipulates thatf ⊗ V is a forward simulation from c ⊗ e to d ⊗ e.
F (Y ⊗ V )syncY,Vd⊗ e

FY ⊗ FVd⊗e
Y ⊗VF (f ⊗ V )Ff ⊗ Vf ⊗V

F (X ⊗ V )syncX,V
FX ⊗ FV
c⊗e
X ⊗V

c⊗ e

Hence we have shown that c ⊗ e F d ⊗ e.
Compositionality of B is proved by similar arguments. That of BF follows from
the characterization (3.10) of BF .
Can we further interpret the condition in the previous result (namely local monotonicity of ⊗) in terms of more elementary constructs? We have shown that ⊗ on
K(T ) is obtained from a natural transformation
ξX,Y : T X × T Y → T (X × Y )in Sets

compatible with the monad structure of T . In fact, a monotone ξ induces a locallymonotone ⊗.
5.5.6 Proposition. Let us take the setting of Proposition 5.5.5, except for local
monotonicity of ⊗ : K(T ) × K(T ) → K(T ). Assume further that– the tensor ⊗ : K(T ) × K(T ) → K(T ) arises from × on Sets via a naturaltransformation ξ, as in (5.23);– the Cppo-enriched structure of K(T ) arises from the Cppo-structures of sets
T Y , in a pointwise manner. That is,


g
X

Y

in K(T )if and only if∀x ∈ X. f (x) T Y g(x) .

fThis is indeed the case for T ∈ {L, P, D}; see Lemma 2.2.6.
If the function ξX,Y : T X × T Y → T (X × Y ) is monotone for each X and Y , then
the tensor ⊗ on K(T ) is locally monotone. Therefore by Proposition 5.5.5 similarityrelations F , B and BF are compositional.

5.6

Summary and future work

145

Each monad T ∈ {L, P, D} of our interest (specifying branching type) comes with anatural transformation ξ which is given by T ’s double strength dst; see (2.14). It iseasy to see that a component of such ξ is monotone. Hence, in order for Proposition 5.5.6 to apply, what we still need is only a proper sync natural transformation.

5.6

Summary and future work

In this chapter we have observed that the microcosm principle (as called by Baez andDolan) brings new mathematical insights into computer science. Speciﬁcally, we havelooked into parallel composition of coalgebras, which would serve as a mathematicalbasis for the study of concurrency. As a purely mathematical expedition, we havepresented a 2-categorical formalization of the microcosm principle, where an algebraic
theory is presented by a Lawvere theory. Turning back to our original motivation,
the formalization was applied to coalgebras and produced some general results which
ensure compositionality and equational properties such as associativity.
There are many questions yet to be answered. Some of them have been alreadymentioned, namely: extending the expressive power of sync (Remark 5.2.3), and aproper treatment of “pseudo” algebraic structures (Section 5.3.3).
On the application side, one direction of future work is to establish a relationshipbetween sync and (syntactic) formats for process algebras. Our sync represents acertain class of operational rules; formats are a more syntactic way to do the same.
Formats which guarantee certain good properties (such as commutativity, see [102])
have been actively studied. Such a format should be obtained by translating e.g. a“commutative” sync into a format.
Another applicational direction is an abstract, categorical account of testing equivalences as introduced in [30].12 In the testing framework parallel composition plays
a crucial role: a system C to be tested is composed with another system T which
represents a test; the behavior of C  T (typically outputting “OK”) tells us if thesystem C passes the test T or not. Therefore the current work (studying parallel
composition of coalgebras) is a ﬁrst step towards “coalgebraic testing.”
On the mathematical side, one direction is to identify more instances of the microcosm principle. Mathematics abounds with the (often implicit) idea of nested
algebraic structures. To name a few: a topological space in a topos which is itself a“generalized topological space”; a category of domains which itself carries a “structure
as a domain.” We wish to turn such an informal statement into a mathematicallyrigorous one, by generalizing the current formalization of the microcosm principle.
As a possible ﬁrst step towards this direction, we are working on formalizing the microcosm principle for ﬁnitary monads which are known to be roughly the same thingas Lawvere theories.
Another direction is a search for n-folded nested algebraic structures. In thecurrent work we have concentrated on two levels of interpretation. We are not (yet)
12 The word “testing” here means something diﬀerent from the one in testing situations (Section 2.5).

146

5

Foundational study: concurrency and the microcosm principle

aware of examples with three or more levels; an example might be an internal category
in an internal category.
The simplicial category Δ [96, Section VII.5] can be thought of as a “universal” microcosm model for the theory Mon of monoids, in the sense of [96, Proposition VII.5.1]. Further investigation is needed to make clear in which exact sense it isuniversal; and to generalize the construction of such a universal model to an arbitrary
algebraic theory L. The construction of Δ seems much related to the construction
called categoriﬁcation [8].

Appendix A
Preliminaries

A.1

Initial/final sequences

Here we recall the standard construction [5] of an initial algebra (or a ﬁnal coalgebra)
via the initial (or ﬁnal) sequence. Notice that the base category need not be Sets.
Let C be a category with an initial object 0, and F : C → C be an endofunctor.
The initial sequence 1 of F is a diagram
0

¡

F ¡

F0

···

F n−1 ¡

F n0

Fn ¡

···

where ¡ : 0 → X is the unique arrow.
Now assume that:αnA)n<ω ;– the initial sequence has an ω-colimit2 (F n 0 −→– the functor F preserves that ω-colimit.
Then we have two cocones (αn )n<ω and (F αn−1 )n<ω over the initial sequence. Moreover, the latter is again a colimit: hence we have mediating isomorphisms between
these cones.
αn
···

αn+1

n

F n0

F ¡

···

F n+1 0F αn

F αn−1∼=
A.1.1 Proposition. The F -algebra α : F A →A is initial.
1 In this thesis we consider only initial/ﬁnal sequences of length ω.

2 An ω-colimit is a colimit of a diagram whose shape is the ordinal ω.

147

A(colimit)

α ∼
= α−1
FA

(colimit)

148

A

Preliminaries


Proof. For future reference we prove the dual result: see Proposition A.1.2.

The dual of this construction yields a ﬁnal F -coalgebra. Assume that the basecategory C has a terminal object 1. The ﬁnal sequence of F is
1

!

F1

F!

F n−1 !

···

Fn !

F n1

··· ,
ζn

where ! : X → 1 is the unique arrow. Assume that it has an ω op -limit (Z −→F n 1)n<ω , and also that F preserves that ω op -limit. We have the following situation.
ζn
···

n

F n1

F !

F n+1 1Z···

ζ −1 ∼= ζF ζnF ζn−1(limit)ζn+1

FZ(limit)∼=A.1.2 Proposition. The coalgebra ζ : Z →F Z is ﬁnal.
γnProof. Any F -coalgebra c : X → F X induces a cone (X −→ F n 1)n<ω over the ﬁnal
sequence in the following way.
γ0 = ! : X −→ 1 ,γn+1 = F γn ◦ c .

Now we can prove the following: for an arrow f : X → Z, f is a morphism of
coalgebras from c to ζ if and only if f is a mediating arrow from the cone (γn )n<ω to
the limit (ζn )n<ω . Hence such a morphism of coalgebras uniquely exists.
It is easy to see that every shapely functor in Sets preserves ω-colimits and ω op limits. Hence we have the following.
A.1.3 Lemma. A shapely functor F has both an initial algebra and a ﬁnal coalgebrain Sets.


A.2

Limit-colimit coincidence

We recall some relevant notions and results from [127]. The idea is that in a suitable order-enriched setting, (co)limits are equivalently described as an order-theoretic
notion of O-(co)limits. Due to the inherent coincidence between O-limits and Ocolimits, we also obtain the so-called limit-colimit coincidence.
limit

colimitO-limitO-colimit
obvious coincidence
The notions of O-(co)limits are stated in terms of embedding-projection pairs which
we can deﬁne in an order-enriched category. In the sequel we assume the Cppoenriched structure.

A.2

Limit-colimit coincidence

149

A.2.1 Deﬁnition (Embedding-projection pairs). Let C be a Cppo-enriched category. A pair of arrowseXYpin C is said to be an embedding-projection pair if we have p ◦ e = id and e ◦ p  id.
Diagrammatically presented,
e

X

Y

id

p


id

X

Y.

e

By p ◦ e = id we automatically have that e is a mono and p is an epi. Both split.
A.2.2 Proposition. Let (e, p), (e , p ) : X
Y be two embedding-projection pairs
with the same domain and codomain. Then e  e holds if and only if p  p. As aconsequence, one component of an embedding-projection pair determines the other. This proposition justiﬁes the notation eP for the projection corresponding to a given
embedding e, and pE for the embedding corresponding to a given projection p. It iseasy to check that(e ◦ f )P = f P ◦ eP

(p ◦ q)E = q E ◦ pE .

and
f0

f1

A.2.3 Deﬁnition (O-(co)limits). Let X0 → X1 → · · · be an ω-chain in a CppoσnC)n<ω over this chain is said to be an O-colimit if:enriched C. A cocone (Xn →– each σn is an embedding;σnP
σn– the sequence of arrows ( CXnC )n<ω is increasing. Moreover its
join taken in the cpo C(C, C) is idC .
C

σ0
σ1
X0
γn

σ0P
f0

σ1P
X1

···
···

f1
g0

g1

Dually, a cone (C → Yn )n<ω over an ω op -chain Y0 ← Y1 ← · · · is an O-limit if:
each γn is a projection, and the sequence (γnE ◦ γn : C → C)n<ω is increasing and its
join is idC .
The following proposition establishes the equivalence between (co)limits and O(co)limits. For its full proof the reader is referred to [127].

150

A

Preliminaries
e

e

0
1
A.2.4 Proposition (Propositions A–D in [127]). Let X0 →X1 →· · · be an ω-chain
where each en is an embedding.

σn1. Let (Xn →C)n<ω be the colimit over the chain. Then each σn is also anembedding. Moreover, (σn )n<ω is an O-colimit.

σnC)n<ω over the chain is a colimit.
2. Conversely, an O-colimit (Xn →p0p1

Dually, let X0 ← X1 ← · · · be an ω op -chain where each pn is a projection.
τn
3. Let (D →Xn )n<ω be a limit over the chain. Then each τn is also a projection.
Moreover (τn )n<ω is an O-limit.

τnXn )n<ω over the chain is a limit.
4. Conversely, an O-limit (D →βnProof. For later reference we present the proof of (4). Let (B → Xn )n<ω be an
p0
p1
arbitrary cone over the chain X0 ← X1 ← · · · . First we prove the uniqueness of amediating map f : B → D.
%E
f = idD ◦ f =(τn )n<ω is an O-limitn<ω (τn ◦ τn ) ◦ f%
Ecomposition is continuous= n<ω (τn ◦ τn ◦ f )%E
f is mediating .
= n<ω (τn ◦ βn )We conclude the proof by showing that the sequence (τnE ◦ βn )n<ω is increasing,hence such f indeed exists.
EE
τnE ◦ βn = τnE ◦ pn ◦ βn+1 = τn+1
◦ pE
n ◦ pn ◦ βn+1  τn+1 ◦ βn+1

The last inequality holds because pEn ◦ pn  id from the deﬁnition of embeddingprojection pairs.

e

e

0
1
X1 →
· · · be an ω-chain
A.2.5 Theorem (Limit-colimit coincidence). Let X0 →σnwhere each en is an embedding, and (Xn → C)n<ω be the colimit over the chain.

σPnThen each σn is an embedding, and the cone (C →Xn )n<ω is a limit over the ω op -

eP

eP

0
1
chain X0 ←
X1 ←
···.

C

σ0

: colimit

σ1
X0

e0

X1

e1

···

C

σ0P
=⇒
X0

eP
0

X1

σ1P
eP
1

: limit···

Dually, the limit of an ω op -chain of projections consists of projections. By taking
the corresponding embeddings we obtain a colimit of an ω-chain of embeddings.

A.2

Limit-colimit coincidence

151

Proof. We prove the ﬁrst statement. By Proposition A.2.4 each σn is an embedding,eP0
and moreover (σn )n<ω is an O-colimit. Now obviously (σnP )n<ω is a cone over X0 ←

eP

1
X1 ←
· · · . Here we use the inherent coincidence of O-(co)limits: namely, the condition
that (σn )n<ω is an O-colimit is exactly the same as that (σnP )n<ω is an O-limit. We
use Proposition A.2.4 to conclude the proof.


152

A

Preliminaries

Bibliography[1] M. Abadi and A.D. Gordon. A calculus for cryptographic protocols: The Spi
calculus. In Fourth ACM Conference on Computer and Communications Security, pp. 36–47. ACM Press, 1997. 100[2] S. Abramsky and A. Jung. Domain theory. In S. Abramsky, D.M. Gabbai and
T.S.E. Maibaum, editors, Handbook of Logic in Computer Science, vol. 3, pp.
1–168. Oxford Univ. Press, 1994. 35, 43[3] L. Aceto, W. Fokkink and C. Verhoef. Structural operational semantics. In
J. Bergstra, A. Ponse and S. Smolka, editors, Handbook of Process Algebra, pp.
197–292. Elsevier, 2001. 112[4] P. Aczel. Non-well-founded sets. CSLI Lecture Notes 14, Stanford, 1988. 9[5] J. Adámek and V. Koubek. Least ﬁxed point of a functor. Journ. Comp. Syst.
Sci, 19(2):163–178, 1979. 37, 147[6] Anonymity bibliography, 2007. http://freehaven.net/anonbib. 88[7] N. Attrapadung, Y. Cui, D. Galindo, G. Hanaoka, I. Hasuo, H. Imai, K. Matsuura, P. Yang and R. Zhang. Relations among notions of security for identity
based encryption schemes. In Latin American Theoretical Informatics Symposium (LATIN ’06), vol. 3887 of Lect. Notes Comp. Sci., pp. 130–141. Springer,
Berlin, 2006.
[8] J.C. Baez and J. Dolan. Categoriﬁcation. Contemp. Math., 230:1–36, 1998. 146[9] J.C. Baez and J. Dolan. Higher dimensional algebra III: n-categories and thealgebra of opetopes. Adv. Math, 135:145–206, 1998. 18, 117
153

154

Bibliography[10] M. Barr. Terminal coalgebras in well-founded set theory. Theor. Comp. Sci.,
114(2):299–315, 1993. Corrigendum in Theor. Comp. Sci. 124:189–192, 1994. 9[11] M. Barr and C. Wells. Toposes, Triples and Theories. Springer, Berlin, 1985.
Available online. 28, 30, 125[12] F. Bartels. On generalised coinduction and probabilistic speciﬁcation formats.
Distributive laws in coalgebraic modelling. PhD thesis, Free Univ. Amsterdam,
2004. 27, 58, 118[13] J.A. Bergstra and J.W. Klop. ACPτ : A universal axiom system for process
speciﬁcation. In M. Wirsing and J.A. Bergstra, editors, Algebraic Methods, vol.
394 of Lecture Notes in Computer Science, pp. 447–463. Springer, 1987. 121[14] I. Beylin and P. Dybjer. Extracting a proof of coherence for monoidal categories
from a proof of normalization for monoids. In S. Berardi and M. Coppo, editors,
TYPES, vol. 1158 of Lect. Notes Comp. Sci., pp. 47–61. Springer, 1995. 128[15] M. Bhargava and C. Palamidessi. Probabilistic anonymity. In M. Abadi and
L. de Alfaro, editors, CONCUR 2005, vol. 3653 of Lect. Notes Comp. Sci., pp.
171–185. Springer, 2005. 87, 88, 90, 92, 93, 96, 99, 100, 112[16] R. Bird and O. de Moor. Algebra of Programmming. Prentice Hall Int. Series
in Comput. Sci., 1996. 27, 44, 45[17] M.M. Bonsangue and A. Kurz. Duality for logics of transition systems. In
V. Sassone, editor, FoSSaCS, vol. 3441 of Lect. Notes Comp. Sci., pp. 455–469.
Springer, 2005. 26, 51, 55[18] M.M. Bonsangue and A. Kurz. Presenting functors by operations and equations.
In L. Aceto and A. Ingólfsdóttir, editors, FoSSaCS, vol. 3921 of Lect. Notes
Comp. Sci., pp. 172–186. Springer, 2006. 26, 51, 55[19] F. Borceux. Handbook of Categorical Algebra, vol. 50, 51 and 52 of Encyclopediaof Mathematics. Cambridge Univ. Press, 1994. 19, 35, 36, 124, 128, 129, 134,
142
[20] S. Briais. ABC bisimulation checker. http://lamp.epfl.ch/∼sbriais/abc/,
2003. 112[21] D. Cancila and F. Honsell. A coalgebraic description of web interactions. In
C. Blundo and C. Laneve, editors, ICTCS, vol. 2841 of Lecture Notes in Computer Science, pp. 271–283. Springer, 2003. 63[22] K. Chatzikokolakis, C. Palamidessi and P. Panangaden. Probability of error in
information-hiding protocols. In IEEE Computer Security Foundations Symposium (CSF20), pp. 341–354. 2007. 88

Bibliography155[23] K. Chatzikokolakis and C. Palamidessi. Probable innocence revisited. Theor.
Comp. Sci., 367(1–2):123–138, 2006. 89, 94, 99, 101[24] K. Chatzikokolakis and C. Palamidessi. Making random choices invisible to thescheduler. In L. Caires and V.T. Vasconcelos, editors, CONCUR, vol. 4703 of
Lect. Notes Comp. Sci., pp. 42–58. Springer, 2007. 112[25] D. Chaum. The dining cryptographers problem: Unconditional sender andrecipient untraceability. Journ. of Cryptology, 1(1):65–75, 1988. 90[26] L. Cheung. Reconciling Nondeterministic and Probabilistic Choices. PhD thesis,
Radboud Univ. Nijmegen, 2006. 58[27] T. Chothia. Analysing the MUTE anonymous ﬁle-sharing system using the
pi-calculus. In E. Najm, J.F. Pradat-Peyre and V. Donzeau-Gouge, editors,
FORTE, vol. 4229 of Lect. Notes Comp. Sci., pp. 115–130. Springer, 2006. 112[28] T. Chothia. Securing pseudo identities in an anonymous peer-to-peer ﬁle-sharing
network. In International Conference on Security and Privacy in Communication Networks (SecureComm 2007). 2007. 112[29] T. Chothia, S. Orzan, J. Pang and M.T. Dashti. A framework for automaticallychecking anonymity with mCRL. In The 2nd Symposium on Trustworthy Global
Computing (TGC 2006), Lect. Notes Comp. Sci. 2006. 112[30] R. De Nicola and M. Hennessy. Testing equivalences for processes. Theor.
Comp. Sci., 34:83–133, 1984. 145[31] M.P. Fiore. Axiomatic Domain Theory in Categories of Partial Maps. Distinguished Dissertations in Computer Science. Cambridge Univ. Press, 1996. 27,
42, 43[32] M.P. Fiore. A coinduction principle for recursive data types based on bisimulation. Inf. & Comp., 127(2):186–198, 1996. 58, 63, 70, 77[33] M.M. Fokkinga. Monadic maps and folds for arbitrary datatypes. Memoranda
Informatica, University of Twente, 94–28, 1994. 37[34] P.J. Freyd. Algebraically complete categories. In A. Carboni, M.C. Pedicchio
and G. Rosolini, editors, Como Conference on Category Theory, no. 1488 in
Lect. Notes Math., pp. 95–104. Springer, Berlin, 1991. 27, 42, 43[35] P.J. Freyd. Remarks on algebraically compact categories. In M.P. Fourman,
P.T. Johnstone and A.M. Pitts, editors, Applications of Categories in Computer
Science, no. 177 in LMS, pp. 95–106. Cambridge Univ. Press, 1992. 27, 42, 43[36] D. Galindo and I. Hasuo. Security notions for identity based encryption. Cryptology ePrint Archive, Report 2005/253, 2005.

156

Bibliography[37] F.D. Garcia, I. Hasuo, W. Pieters and P. van Rossum. Provable anonymity. In
R. Küsters and J. Mitchell, editors, 3rd ACM Workshop on Formal Methods
in Security Engineering (FMSE05), pp. 63–72. ACM Press, Alexandria , VA,
U.S.A., Nov. 2005. 88[38] S.J. Garland, N.A. Lynch and M. Vaziri. IOA: a language for specifying, programming, and validating distributed systems. MIT Laboratory for Computer
Science, 1997. 86[39] R.J. van Glabbeek. The linear time–branching time spectrum I; the semantics
of concrete, sequential processes. In J.A. Bergstra, A. Ponse and S.A. Smolka,
editors, Handbook of Process Algebra, chap. 1, pp. 3–99. Elsevier, 2001. Available
at http://boole.stanford.edu/pub/spectrum1.ps.gz. 21, 26, 54, 59, 86, 100[40] R.J. van Glabbeek, S.A. Smolka and B. Steﬀen. Reactive, generative, andstratiﬁed models of probabilistic processes. Inf. & Comp., 121:59–80, 1995. 45[41] J.Y. Halpern and K.R. O’Neill. Anonymity and information hiding in multiagent
systems. Journ. of Computer Security, 13(3):483–512, 2005. 88, 89, 93, 94, 99,
100[42] I. Hasuo and B. Jacobs. Coalgebraic trace semantics for probabilistic systems.
In P. Mosses, J. Power and M. Seisenberger, editors, CALCO-jnr Workshop.
2005. 27[43] I. Hasuo and B. Jacobs. Context-free languages via coalgebraic trace semantics. In J.L. Fiadeiro, N. Harman, M. Roggenbach and J.J.M.M. Rutten, editors, International Conference on Algebra and Coalgebra in Computer Science(CALCO’05), vol. 3629 of Lect. Notes Comp. Sci., pp. 213–231. Springer, Berlin,
2005. 14, 27, 31, 48, 49[44] I. Hasuo, B. Jacobs and A. Sokolova. Generic trace theory. In N. Ghani and A.J.
Power, editors, International Workshop on Coalgebraic Methods in Computer
Science (CMCS 2006), vol. 164 of Elect. Notes in Theor. Comp. Sci., pp. 47–65.
Elsevier, Amsterdam, 2006. 14, 27[45] I. Hasuo, B. Jacobs and A. Sokolova. The microcosm principle and concurrency
in coalgebra. In FoSSaCS, Lect. Notes Comp. Sci. 2008. To appear. 19[46] I. Hasuo. Generic forward and backward simulations. In C. Baier and H. Hermanns, editors, International Conference on Concurrency Theory (CONCUR
2006), vol. 4137 of Lect. Notes Comp. Sci., pp. 406–420. Springer, Berlin, 2006.
16[47] I. Hasuo, B. Jacobs and A. Sokolova. Generic trace semantics via coinduction.
Logical Methods in Comp. Sci., 3(4:11), 2007. 14, 27

Bibliography157[48] I. Hasuo, B. Jacobs and T. Uustalu. Categorical views on computations ontrees (extended abstract). In L. Arge, C. Cachin, T. Jurdzinski and A. Tarlecki,
editors, ICALP, vol. 4596 of Lecture Notes in Computer Science, pp. 619–630.
Springer, 2007.
[49] I. Hasuo and R. Kashima. Kripke completeness of ﬁrst-order constructive logics
with strong negation. Logic Journal of the IGPL, 11(6):615–646, 2003.
[50] I. Hasuo and Y. Kawabe. Probabilistic anonymity via coalgebraic simulations.
In R. De Nicola, editor, European Symposium on Programming (ESOP 2007),
vol. 4421 of Lect. Notes Comp. Sci., pp. 379–394. Springer, 2007. 17, 157[51] I. Hasuo, Y. Kawabe and H. Sakurada. Probabilistic anonymity via coalgebraic
simulations, 2007. Extended version of [50]. Submitted for publication. 17[52] M. Hennessy and R. Milner. Algebraic laws for nondeterminism and concurrency. Journ. ACM, 32(1):137–161, 1985. 86[53] O.M. Herescu and C. Palamidessi. Probabilistic asynchronous pi-calculus. In
J. Tiuryn, editor, FoSSaCS, vol. 1784 of Lect. Notes Comp. Sci., pp. 146–160.
Springer, 2000. 112[54] C. Hermida and B. Jacobs. Structural induction and coinduction in a ﬁbrationalsetting. Inf. & Comp., 145:107–152, 1998. 38, 133[55] C.A.R. Hoare. Communicating Sequential Processes. Prentice Hall, 1985. 27,
121[56] C.A.R. Hoare. Data reﬁnement in a categorical setting, 1987. Unpublishedmanuscript. 63, 70, 83[57] D. Hughes and V. Shmatikov. Information hiding, anonymity and privacy: A
modular approach. Journal of Computer Security, 12(1):3–36, 2004. 88[58] J. Hughes and B. Jacobs. Simulations in coalgebra. Theor. Comp. Sci., 327(12):71–108, 2004. 42, 63, 81, 82[59] M. Hyland and A.J. Power. Discrete Lawvere theories and computational eﬀects.
Theor. Comp. Sci., 366(1–2):144–162, 2006. 124[60] B. Jacobs. Semantics of weakening and contraction. Ann. Pure & Appl. Logic,
69(1):73–106, 1994. 66[61] B. Jacobs. Categorical Logic and Type Theory. North Holland, Amsterdam,
1999. v, 53, 125[62] B. Jacobs. Trace semantics for coalgebras. In J. Adámek and S. Milius, editors,
Coalgebraic Methods in Computer Science, vol. 106 of Elect. Notes in Theor.
Comp. Sci. Elsevier, Amsterdam, 2004. 26, 27, 33, 48, 49

158

Bibliography[63] B. Jacobs and I. Hasuo. Freyd is Kleisli, for Arrows. In C. McBride andT. Uustalu, editors, Workshop on Mathematically Structured Functional Programming (MSFP 2006), eWiC. 2006.
[64] B. Jacobs and J. Hughes. Simulations in coalgebra. In H.P. Gumm, editor,
Coalgebraic Methods in Computer Science, no. 82(1) in Elect. Notes in Theor.
Comp. Sci. Elsevier, Amsterdam, 2003. 63, 81, 82[65] B. Jacobs and J.J.M.M. Rutten. A tutorial on (co)algebras and (co)induction.
EATCS Bulletin, 62:222–259, 1997. 3, 7, 19, 23, 27[66] B. Jacobs. Introduction to coalgebra. Towards mathematics of states and observations, 2005. Draft of a book, http://www.cs.ru.nl/B.Jacobs/PAPERS/.
3, 4, 19, 23[67] B. Jacobs. A bialgebraic review of deterministic automata, regular expressions
and languages. In K. Futatsugi, J.P. Jouannaud and J. Meseguer, editors,
Essays Dedicated to Joseph A. Goguen, vol. 4060 of Lect. Notes Comp. Sci., pp.
375–404. Springer, 2006. 27, 50, 118[68] B. Jacobs and I. Hasuo. Semantics and logic for security protocols. Journ. ofComputer Security, 2007. To appear.
[69] C.B. Jay. A semantics for shape. Science of Comput. Progr., 25:251–283, 1995.
34[70] P.T. Johnstone, A.J. Power, T. Tsujishita, H. Watanabe and J. Worrell. An axiomatics for categories of transition systems as coalgebras. In Logic in Computer
Science. IEEE, Computer Science Press, 1998. 121, 122[71] Y. Kawabe, K. Mano, H. Sakurada and Y. Tsukada. Backward simulations
for anonymity. In International Workshop on Issues in the Theory of Security(WITS ’06). 2006. 17, 61, 87, 88, 101, 104, 107, 112, 113[72] Y. Kawabe, K. Mano, H. Sakurada and Y. Tsukada. Theorem-proving
anonymity of inﬁnite state systems. Inform. Process. Lett., 101(1):46–51, 2007.
17, 87, 88, 101, 104, 107, 112[73] G.M. Kelly. Basic Concepts of Enriched Category Theory. No. 64 in LMS.
Cambridge Univ. Press, 1982. 35[74] G.M. Kelly. Elementary observations on 2-categorical limits. Bull. Austr. Math.
Soc., 39:301–317, 1989. 133[75] M. Kick, A.J. Power and A. Simpson. Coalgebraic semantics for timed processes.
Inf. & Comp., 204(4):588–609, 2006. 25, 27, 118[76] Y. Kinoshita and J. Power. Data reﬁnement and algebraic structure. Acta
Informatica, 36:693–719, 2000. 63, 70, 83, 84

Bibliography

159[77] N. Klarlund and F.B. Schneider. Verifying safety properties using inﬁnite-state
automata. Tech. Rep. 89-1039, Department of Computer Science, Cornell University, Ithaca, New York, 1989. 79[78] B. Klin. From bialgebraic semantics to congruence formats. In Workshop on
Structural Operational Semantics (SOS 2004), vol. 128 of Elect. Notes in Theor.
Comp. Sci., pp. 3–37. 2005. 27, 58, 118[79] B. Klin. Bialgebraic operational semantics and modal logic. In Logic in Computer Science, pp. 336–345. IEEE Computer Society, 2007. 26, 27, 118[80] B. Klin. Coalgebraic modal logic beyond Sets. In MFPS XXIII, vol. 173, pp.
177–201. Elsevier, Amsterdam, 2007. 26, 51, 53, 54[81] A. Kock. Monads on symmetric monoidal closed categories. Arch. Math.,
XXI:1–10, 1970. 33[82] A. Kock and G.E. Reyes. Doctrines in categorical logic. In J. Barwise, editor, Handbook of Mathematical Logic, pp. 283–313. North-Holland, Amsterdam,
1977. 19, 124[83] C. Kupke, A. Kurz and Y. Venema. Stone coalgebras. Theor. Comp. Sci.,
327(1-2):109–134, 2004. 26[84] C. Kupke, A. Kurz and D. Pattinson. Algebraic semantics for coalgebraic logics.
Elect. Notes in Theor. Comp. Sci., 106:219–241, 2004. 51[85] A. Kurz. Logics for Coalgebras and Applications to Computer Science. PhD
thesis, Universität München, April 2000. 26[86] A. Kurz. Coalgebras and modal logic.
http://www.helsinki.fi/esslli/. 3, 19

Course notes for ESSLLI, 2001.

[87] A. Kurz. Coalgebras and their logics. SIGACT News, 37(2):57–77, 2006. 26, 51[88] K.G. Larsen and A. Skou. Bisimulation through probabilistic testing. Inf. &Comp., 94(1):1–28, 1991. 84, 85[89] F.W. Lawvere. Metric spaces, generalized logic, and closed categories. Seminario Matematico e Fisico. Rendiconti di Milano, 43:135–166, 1973. Reprinted
in Theory and Applications of Categories, 1:1–37, 2002. 35[90] F.W. Lawvere. Functorial Semantics of Algebraic Theories and Some Algebraic
Problems in the Context of Functorial Semantics of Algebraic Theories. PhD
thesis, Columbia University, 1963. Reprints in Theory and Applications of
Categories, 5 (2004) 1–121. 117, 124, 125[91] E.A. Lee. Making concurrency mainstream. Invited talk at CONCUR 2006,
2006. 115

160

Bibliography[92] M. Lenisa, A.J. Power and H. Watanabe. Distributivity for endofunctors,
pointed and co-pointed endofunctors, monads and comonads. In H. Reichel,editor, Coalgebraic Methods in Computer Science, vol. 33 of Elect. Notes in
Theor. Comp. Sci. Elsevier, Amsterdam, 2000. 32[93] M. Lenisa, J. Power and H. Watanabe. Category theory for operational semantics. Theor. Comp. Sci., 327(1–2):135–154, 2004. 32[94] N. Lynch and F. Vaandrager. Forward and backward simulations. I. Untimed
systems. Inf. & Comp., 121(2):214–233, 1995. 15, 61, 62, 71, 74, 79, 82, 89[95] N.A. Lynch, R. Segala and F.W. Vaandrager. Compositionality for probabilistic
automata. In R.M. Amadio and D. Lugiez, editors, CONCUR 2003, vol. 2761
of Lect. Notes Comp. Sci., pp. 204–222. Springer, 2003. 84, 85[96] S. Mac Lane. Categories for the Working Mathematician. Springer, Berlin, 2ndedn., 1998. 2, 19, 28, 30, 38, 128, 135, 146[97] J. McLean. Security models. In J. Marciniak, editor, Encyclopedia of Software
Engineering, pp. 1136–1145. John Wiley & Sons, 1994. 110[98] R. Milner. A Calculus of Communicating Systems. Lect. Notes Comp. Sci.
Springer, Berlin, 1980. 9[99] R. Milner. Communication and Concurrency. Prentice-Hall, 1989. 121[100] E. Moggi. Notions of computation and monads. Inf. & Comp., 93(1):55–92,
1991. 124[101] O. de Moor. Inductive data types for predicate transformers. Inform. Process.
Lett., 43:113–117, 1992. 27, 44, 45[102] M.R. Mousavi, M.A. Reniers and J.F. Groote. A syntactic commutativity format for SOS. Inform. Process. Lett., 93(5):217–223, 2005. 145[103] P.S. Mulry. Lifting theorems for Kleisli categories. In Mathematical Foundationsof Programming Semantics (MFPS IX), pp. 304–319. Springer-Verlag, London,
UK, 1994. 32[104] K. Nishizawa and A.J. Power. Lawvere theories enriched over a general base.
Journ. of Pure & Appl. Algebra, 2006. To appear. 124[105] C. Palamidessi and O.M. Herescu. A randomized encoding of the pi-calculus
with mixed choice. Theor. Comp. Sci., 335(2–3):373–404, 2005. 112[106] A. Pardo. Fusion of recursive programs with computational eﬀects. Theor.
Comp. Sci., 260(1–2):165–207, 2001. 27, 37, 44

Bibliography161[107] D.M.R. Park. Concurrency and automata on inﬁnite sequences. In P. Deussen,
editor, Proceedings 5th GI Conference on Theoretical Computer Science, vol.
104 of Lect. Notes Comp. Sci., pp. 15–32. Springer, Berlin, 1981. 9[108] D. Pattinson. An introduction to the theory of coalgebras. Course notes for
NASSLLI, 2003. http://www.indiana.edu/~nasslli/. 3, 4, 19[109] D. Pavlović, M. Mislove and J.B. Worrell. Testing semantics: connecting processes and process logics. In M. Johnson and V. Vene, editors, Algebraic Methodology and Software Technology (AMAST 2006), vol. 4019 of Lect. Notes Comp.
Sci. Springer, 2006. 26, 51[110] A. Pﬁtzmann and M. Köhntopp.
Anonymity, unobservability, andpseudonymity: A proposal for terminology. Draft, version 0.17, July 2000.
88[111] J. Power and D. Turi. A coalgebraic foundation for linear time semantics. In
Category Theory and Computer Science, vol. 29 of Elect. Notes in Theor. Comp.
Sci. Elsevier, Amsterdam, 1999. 26, 27[112] M.K. Reiter and A.D. Rubin. Crowds: anonymity for Web transactions. ACM
Transactions on Information and System Security, 1(1):66–92, 1998. 88, 89, 90,
93, 94, 99[113] J. Rohrer. MUTE technical details. http://mutenet.sourceforge.net, 2006.
112[114] J.J.M.M. Rutten. Universal coalgebra: a theory of systems. Theor. Comp. Sci.,
249:3–80, 2000. 3, 11, 19, 23, 27[115] J.J.M.M. Rutten. Behavioural diﬀerential equations: a coinductive calculus of
streams, automata, and power series. Theor. Comp. Sci., 308:1–53, 2003. 50[116] J.J.M.M. Rutten and D. Turi. Initial algebra and ﬁnal coalgebra semantics forconcurrency. In J.W. de Bakker, W.P. de Roever and G. Rozenberg, editors,
A Decade of Concurrency, no. 803 in Lect. Notes Comp. Sci., pp. 530–582.
Springer, Berlin, 1994. 26, 27, 49, 118[117] A. Sabelfeld and D. Sands. Probabilistic noninterference for multi-threaded
programs. In Proceedings of the 13th IEEE Computer Security Foundations
Workshop (CSFW’00), pp. 200–214. 2000. 111, 112[118] D. Sangiorgi. On the origins of bisimulation, coinduction, and ﬁxed points.
Tech. rep., Department of Computer Science, University of Bologna, 2007. 7[119] S. Schneider and A. Sidiropoulos. CSP and anonymity. In ESORICS ’96:
Proceedings of the 4th European Symposium on Research in Computer Security,
pp. 198–218. Springer-Verlag, London, UK, 1996. 17, 88, 100

162

Bibliography[120] R. Segala. Modeling and veriﬁcation of randomized distributed real-time systems.
PhD thesis, MIT, 1995. 58, 61, 84, 85[121] R. Segala and N. Lynch. Probabilistic simulations for probabilistic processes.
Nordic Journ. Comput., 2(2):250–273, 1995. 95, 112[122] R. Segala. A compositional trace-based semantics for probabilistic automata. In
International Conference on Concurrency Theory (CONCUR ’95), pp. 234–248.
Springer-Verlag, 1995. 21[123] A. Serjantov. On the Anonymity of Anonymity Systems. PhD thesis, Universityof Cambridge, March 2004. 88[124] V. Shmatikov. Probabilistic model checking of an anonymity system. Journ. ofComputer Security, 12(3):355–377, 2004. 88[125] A.K. Simpson. Recursive types in Kleisli categories, 1992. Unpublished paper,
available at http://homepages.inf.ed.ac.uk/als/Research/. 27, 42[126] G. Smith and D.M. Volpano. Secure information ﬂow in a multi-threaded imperative language. In POPL, pp. 355–364. 1998. 111[127] M.B. Smyth and G.D. Plotkin. The category theoretic solution of recursive
domain equations. SIAM Journ. Comput., 11:761–783, 1982. 24, 27, 37, 148,
149, 150[128] A. Sokolova. Coalgebraic Analysis of Probabilistic Systems. PhD thesis, Techn.
Univ. Eindhoven, 2005. 45, 84[129] C. Stirling. Bisimulation and language equivalence. In R.J.G.B. de Queiroz,
editor, Logic for concurrency and synchronisation, vol. 18 of Trends in Logic,
pp. 269–284. Kluwer Academic Publishers, Norwell, MA, USA, 2003. 12[130] M. Stoelinga and F.W. Vaandrager. A testing scenario for probabilistic automata. In J.C.M. Baeten, J.K. Lenstra, J. Parrow and G.J. Woeginger, editors,
ICALP, vol. 2719 of Lect. Notes Comp. Sci., pp. 464–477. Springer, 2003. 26[131] R. Street. Fibrations and Yoneda’s lemma in a 2-category. In G.M. Kelly,
editor, Proc. Sydney Category Theory Seminar 1972/1973, no. 420 in Lect.
Notes Math., pp. 104–133. Springer, Berlin, 1974. 133[132] R. Tix, K. Keimel and G.D. Plotkin. Semantic domains for combining probability and non-determinism. Elect. Notes in Theor. Comp. Sci., 129:1–104, 2005.
58[133] V. Trnková. General theory of relational automata. Fund. Informaticae, 3:189–
233, 1980. 33

Bibliography163[134] D. Turi and G. Plotkin. Towards a mathematical operational semantics. In
Logic in Computer Science, pp. 280–291. IEEE, Computer Science Press, 1997.
27, 58, 118, 122[135] D. Turi and J.J.M.M. Rutten. On the foundations of ﬁnal semantics: nonstandard sets, metric spaces and partial orders. Math. Struct. in Comp. Sci.,
8(5):481–540, 1998. 58, 63[136] D. Varacca and G. Winskel. Distributing probabililty over nondeterminism.
Math. Struct. in Comp. Sci., 16(1):87–113, 2006. 58, 85[137] M.Y. Vardi. Automatic veriﬁcation of probabilistic concurrent ﬁnite-state programs. In FOCS ’85, pp. 327–338. 1985. 58[138] D.M. Volpano and G. Smith. Probabilistic noninterference in a concurrent
language. Journ. of Computer Security, 7(1), 1999. 111, 112[139] H. Watanabe, K. Nishizawa and O. Takaki. A coalgebraic representation of
reduction by cone of inﬂuence. Elect. Notes in Theor. Comp. Sci., 164(1):177–
194, 2006. 63

IndexEilenberg-Moore –, 2
ﬁnal –, 7functor –, 2
coinduction, 7– deﬁnition principle, 7– proof principle, 7commutative monad, 33
completenessof simulation, 74
backward simulation, 69
compositionality, 115
for anonymity automaton, 103
coalgebraic –, 120
for extended anonymity automaton,
general –, 137
109
computer system, 1
backward-forward simulation, 74
concurrency, 115
bisimilarity, 9, 11
conditional anonymity, 100
bisimulation, 11
congruence, 116
black-box view, 6
context-free grammar, 25
bottom, 30
Cppo-enrichedbranching
category, 35
non-deterministic –, 4functor, 36
branching type, 24
Crowds, 93
CSP, 121
CCS, 121
culprit, 88
CFG, see context-free grammarclassifying category, 125
denotation, 51
Dining Cryptographers, 90
coalgebra, 2
accepted language, 12, 22
ACP, 121
algebraic speciﬁcation, 125
algebraically compact category, 42
anonymity automaton, 95
extended –, 107
anonymized automaton, 102
axiomatic domain theory, 42164Index
distribution monad, 30
distributive law, 32
dynamics, 3, 65
embedding, 149embedding-projection pair, 149
expressive
testing situation, 54
extended anonymity automaton, 107
FCS-equivalence, 52
ﬁnal
coalgebra, 7object, 7
ﬁnal sequence, 148
ﬁnite trace semantics, 46
for (T, F )-system, 67
forward simulation, 69
for anonymity automaton, 103
for extended anonymity automaton,
109
FP-category, 124
FP-functor, 124
functional bisimulation, 6
general soundness theorem, 78
GSOS-rules, 122hybrid simulation, 74

165

lax –, 132
oplax –, 132
lift monad, 25
liftingof functor from Sets to K(T ), 32
limit-colimit coincidence, 150
livelock, 48
L-object, 129
localcontinuity, 36
monotonicity, 36
LTS, see labeled transition system
microcosm model, 129
microcosm principle, 117
modiﬁcation, 134, 142
monad, 28
commutative –, 33
monoid, 117monoidal category, 117
strictly –, 118monoidal functor, 121morphism of L-object, 134
morphism of coalgebra, 5lax –, 62
oplax –, 62
multiset, 25

Nat (category), 124
non-deterministic
induction, 7
automaton, 4
initial algebra-ﬁnal coalgebra coincidence,branching, 438
non-interference, 110
initial sequence, 147
inner model, see L-object
O-colimit, 149
innocent automaton, 109
O-limit, 149
inserter, 133
oplax L-functor, 132
oplax morphism of coalgebra, 62
labeled transition system, 4outer model, see L-category
language equivalence, 12
Lawvere theory, 124
possibly-inﬁnite trace semantics, 48
lax L-functor, 132
powerset monad, 25
lax morphism of coalgebra, 62
preservation of weak pullback, 11
L-category, 126
probabilistic anonymity
L-functor, 126
conditional anonymity, 100

166

Index

probable innocence, 94, 101
strong –, 92, 100
probabilistic simulation, 73
probable innocence, 94, 101
process algebra, 112
projection, 149
pseudo functor, 127real valuation, 25
relation lifting, 33
shapely functor, 34
similarity, 69, 74
simplicial category, 145
simulation
backward –, 69
backward-forward –, 74
forward –, 69
hybrid –, 74
probabilistic –, 73
skeletal parse tree, 48
sketch, 125
soundnessof simulation, 74, 78
start state map, 65
state, 3state space, 3
stream automaton, 3
strictly monoidal category, 118
strong probabilistic anonymity, 92, 100
subdistribution monad, 25
synchronization
natural transformation, 120
synchronization tree, 9syntactic format, 145
system(T, F )-–, 65
tensor, 119
terminal object, 7
testing equivalence, 52
testing situation, 51(T, F )-system, 65
timed system, 25
trace

distribution, 22
equivalence, 11semantics, 13set, 22
trace semantics
ﬁnite –, 46
for (T, F )-system, 67
for anonymity automaton, 98
possibly-inﬁnite –, 48
trace situation, 38transition, 3transition type, 25
type system, 111

Summary

The aim of this thesis is to obtain better understanding of the nature of computer
systems, that is, to develop a mathematical theory of computer systems. By computer
systems we mean information-processing systems consisting of computers. We cannot
overemphasize their important roles in the modern world. Unfortunately, however,computer systems are very much error-prone at the same time. This thesis ultimately
aims at proper understanding of computer systems which will help us getting themright; we do so through extending the theory of coalgebras.
The use of coalgebras as a mathematical model of state-based systems has been
increasingly recognized in the last couple of decades. We follow this view since, we
believe, the theory of coalgebras has a right balance of (potential) applicability andmathematical simplicity. The very core of the existing theory of coalgebras that westart with can be summarized as follows.
– A system is modeled mathematically as a coalgebra;– a behavior-preserving map between systems as a morphism of coalgebras; and– the behavior of a system is given by the principle of coinduction.
These points have been established by many authors in a large body of existing work.
In each chapter of this thesis, however, we try to shed new light on them.
Our most emphasis is on, among the three points listed above, the principle ofcoinduction which assigns to a system (i.e. a coalgebra) its behavior in the form of theunique map to a ﬁnal coalgebra. In the standard setting where the base category is
Sets, the behavior thus captured respects bisimilarity—which is one possible choicein the spectrum of many diﬀerent notions of behavioral equivalences. In Chapter 2
we establish an appropriate mathematical framework to capture a diﬀerent notion of
behavior—namely trace semantics—also by coinduction. To put it brieﬂy, when wemove the base category from Sets to a suitable Kleisli category, then the notion of
167

168

Summary

behaviors captured by coinduction shifts from bisimilarity to trace semantics. This
works equally for both (non-deterministic) trace set semantics and (probabilistic)
trace distribution semantics.
Then a natural question arises: what is a morphism of coalgebras in a Kleisli
category? In Chapter 3 it is given an interpretation as a forward/backward simulation.
Use of simulations is an important technique in formal veriﬁcation of systems, inwhich the soundness theorem plays a crucial role. Our categorical formulation ofsimulations allows us to prove a generic soundness theorem which works for a wide
variety of systems (e.g. non-deterministic or probabilistic) and whose proof is oncefor-all by simple categorical arguments. This—together with Chapter 2—establishes
a generic, coalgebraic theory of traces and simulations.
It is this generic theory which is exploited in Chapter 4 to verify anonymity of
network protocols. More speciﬁcally, we start with an existing simulation-based proof
method for non-deterministic anonymity; we make it probabilistic to obtain a proof
method for probabilistic anonymity. This technical jump from non-determinism toprobability is minor for us since, in the generic theory of traces and simulations
established earlier in Chapter 2–3, diﬀerent types of branching (non-determinism vs.
probability) are modeled exactly in the same manner, only by diﬀerent parameters.
In other words, what one can do in a non-deterministic setting can be also done in aprobabilistic setting.
Finally, in Chapter 5 we deal with the issue of concurrency which is a major challenge in the study of computer systems. In our coalgebraic study of systems, compositionality—compatibility of behavior and concurrency—is one of our ﬁrst concerns.
An attempt to formulate compositionality in coalgebraic terms reveals signiﬁcance of
higher-dimensional algebraic structures, the so-called microcosm principle. This is
how we come to a highly abstract mathematical expedition of formalizing the microcosm principle in 2-categories. It is more than just an abstract nonsense: we apply theobtained formalization to the original coalgebraic setting and derive a generic compositionality theorem. It automatically ensures compositionality for a certain class ofconcurrency situations.

Samenvatting (Dutch summary)Het doel van dit proefschrift is om een beter inzicht in de aard van computersystemen
te bereiken, dat wil zeggen, om een wiskundige theorie van computersystemen te
ontwikkelen. Met computersystemen bedoelen we informatieverwerkende systemen
die bestaan uit computers. Hun belangrijke rol in de moderne wereld is nauwelijks teoverdrijven. Tegelijkertijd zijn computersystemen helaas echter zeer bevattelijk voor
fouten. Door hun karakter goed te doorzien, draagt dit proefschrift uiteindelijk bij
aan een foutloze constructie van computersystemen; we doen dit door de theorie vancoalgebras uit te breiden.
Het gebruik van coalgebras is de afgelopen decennia opgeëist als een wiskundig
model van toestandsystemen. Wij hangen deze visie aan omdat, volgens ons, detheorie van coalgebras de juiste balans vindt tussen (mogelijke) toepasbaarheid en
wiskundige eenvoud. Het hart van de bestaande theorie van coalgebras waar we mee
beginnen kan als volgt worden samengevat.
– Een systeem wordt wiskundig gemodelleerd als een coalgebra;– een gedragsrespecterende afbeelding tussen systemen als een morﬁsme van coalgebras; en– het gedrag van een systeem wordt vastgelegd door het principe van coinductie.
Deze visie is bewerkstelligd door vele auteurs, in een groot aantal bestaande werken.
Desondanks probeert ieder hoofdstuk van dit proefschrift om er nieuw licht op tewerpen.
Van de drie bovengenoemde punten leggen we de meeste nadruk op het principe
van coinductie, dat van ieder systeem (coalgebra) haar gedrag vastlegt in de vorm
van een unieke afbeelding naar een ﬁnale coalgebra. In de gebruikelijke situatie, waar
de basiscategorie Sets is, respecteert het aldus vastgelegde gedrag bisimilariteit—
wat trouwens slechts een van de mogelijke keuzes is uit een spectrum van gedragse169

170

Samenvatting (Dutch summary)quivalenties. Hoofdstuk 2 bewerkstelligt een passend wiskundig raamwerk om ook
een andere notie van gedrag—namelijk trace semantiek —door coinductie te vangen.
Kort gezegd: als we de basiscategorie van Sets naar een geschikte Kleisli categorie
verplaatsen, dan verandert de notie van gedrag zoals vastgelegd door coinductie vanbisimilariteit naar trace semantiek. Dit werkt net zo goed voor (non-deterministische)trace verzamelingssemantiek als voor (probabilistische) trace distributiesemantiek.
Een natuurlijke vraag werpt zich dan op: wat is een morﬁsme van coalgebras in een
Kleisli categorie? In hoofdstuk 3 wordt dit ingevuld als een interpretatie van een voorwaarts/achterwaarts simulatie. Het gebruik van simulaties is een belangrijke techniek
in formele veriﬁcatie van systemen, waar soundnessstellingen een cruciale rol spelen. Onze categorische formulering van simulaties stelt ons in staat om een generieke
soundnessstelling te bewijzen, die opgaat voor een breed scala aan systemen (zoals
non-deterministische en probabilistische), en het bewijs waarvan eens-en-voor-al isdoor eenvoudige categorische argumenten. Dit—gecombineerd met Hoofdstuk 2—
geeft een generieke, coalgebraı̈sche theorie van traces en simulaties.
Het is deze generieke theorie die we inzetten in Hoofdstuk 4 om anonimiteit van
netwerkprotocollen te veriﬁëren. Preciezer gezegd beginnen we met een bestaande
bewijsmethode voor non-deterministische anonimiteit gebaseerd op simulaties, en
maken haar probabilistisch om een bewijsmethode te krijgen voor probabilistischeanonimiteit. Deze technische sprong van non-determinisme naar probabilisme is voor
ons een kleine, omdat in de generieke theorie van traces en simulaties van Hoofdstuk 2–3, verschillende soorten vertakking (non-determinisme en probabilisme) op
precies dezelfde manier gemodelleerd worden, op verschillende parameters na. Anders gezegd, wat met non-determinisme bereikt kan worden, kan ook probabilistischgedaan worden.
Hoofdstuk 5 behandelt tenslotte de kwestie van concurrency, een grote uitdaging
binnen de studie van computer systemen. In onze coalgebraı̈sche studie van systemen is compositionaliteit—compatibiliteit van gedrag en concurrency—een van deeerste aandachtspunten. Een poging om compositionaliteit in coalgebraı̈sche termen
te formuleren onthult het belang van hoger-dimensionale algebraı̈sche structuren, het
zogenaamde microcosmos principe. Zo komen we tot een zeer abstracte wiskundige
expeditie om het microcosmos principe te formalizeren met 2-categorieen. Dit is meer
dan enkel abstracte onzin: we passen de verkregen formalizatie toe op de originele
coalgebraı̈sche situatie en leiden zo een generieke compostionaliteitsstelling af. Deze
verzekert compositionaliteit voor een bepaalde klasse van situaties met concurrency.

Curriculum vitae

Born on 27 September 1978 in Omuta, Japan
1994–1997 La Salle High School, Kagoshima, Japan
1997–2002 BSc in Mathematics, University of Tokyo, Japan
2002–2004 MSc in Mathematical and Computing Sciences, Tokyo Institute of Technology, Japan. Thesis title: Kripke Completeness of First-Order Constructive
Logics with Strong Negation, supervised by dr. Ryo Kashima
2004–2008 PhD student in Security of Systems group, Institute for Computing andInformation Sciences, Radboud University Nijmegen, the Netherlands
2007– Assistant Professor, Research Institute for Mathematical Sciences, Kyoto University, Japan
2007– Researcher, PRESTO Research Promotion Program, Japan Science and Technology Agency

171

Titles in the IPA Dissertation Series since 2002
M.C. van Wezel. Neural Networks
for Intelligent Data Analysis: theoretical and experimental aspects. Faculty ofMathematics and Natural Sciences, UL.
2002-01
V. Bos and J.J.T. Kleijn. Formal
Speciﬁcation and Analysis of Industrial
Systems. Faculty of Mathematics andComputer Science and Faculty of Mechanical Engineering, TU/e. 2002-02
T. Kuipers. Techniques for Understanding Legacy Software Systems. Faculty of Natural Sciences, Mathematics
and Computer Science, UvA. 2002-03
S.P. Luttik. Choice Quantiﬁcation in
Process Algebra. Faculty of Natural Sciences, Mathematics, and Computer Science, UvA. 2002-04
R.J. Willemen.
School Timetable
Construction: Algorithms and Complexity. Faculty of Mathematics and Computer Science, TU/e. 2002-05
M.I.A. Stoelinga. Alea Jacta Est:
Veriﬁcation of Probabilistic, Real-timeand Parametric Systems. Faculty of Science, Mathematics and Computer Science, KUN. 2002-06

D. Tauritz. Adaptive Information Filtering: Concepts and Algorithms. Faculty of Mathematics and Natural Sciences, UL. 2002-10
M.B. van der Zwaag. Models and
Logics for Process Algebra.
Facultyof Natural Sciences, Mathematics, andComputer Science, UvA. 2002-11
J.I. den Hartog. Probabilistic Extensions of Semantical Models. Faculty of
Sciences, Division of Mathematics andComputer Science, VUA. 2002-12
L. Moonen. Exploring Software Systems.
Faculty of Natural Sciences,
Mathematics, and Computer Science,
UvA. 2002-13
J.I. van Hemert. Applying Evolutionary Computation to Constraint Satisfaction and Data Mining. Faculty of Mathematics and Natural Sciences, UL. 200214
S. Andova. Probabilistic Process Algebra. Faculty of Mathematics and Computer Science, TU/e. 2002-15
Y.S. Usenko. Linearization in μCRL.
Faculty of Mathematics and Computer
Science, TU/e. 2002-16

N. van Vugt. Models of MolecularComputing. Faculty of Mathematics andNatural Sciences, UL. 2002-07

J.J.D. Aerts.
Random Redundant
Storage for Video on Demand. Facultyof Mathematics and Computer Science,
TU/e. 2003-01

A. Fehnker. Citius, Vilius, Melius:
Guiding and Cost-Optimality in Model
Checking of Timed and Hybrid Systems.
Faculty of Science, Mathematics andComputer Science, KUN. 2002-08

M. de Jonge.
To Reuse or To
Be Reused: Techniques for component
composition and construction. Facultyof Natural Sciences, Mathematics, andComputer Science, UvA. 2003-02

R. van Stee. On-line Scheduling and
Bin Packing. Faculty of Mathematics
and Natural Sciences, UL. 2002-09

J.M.W. Visser. Generic Traversal
over Typed Source Code Representations.
Faculty of Natural Sciences,

Mathematics, and Computer Science,
UvA. 2003-03
S.M. Bohte. Spiking Neural Networks.
Faculty of Mathematics and Natural Sciences, UL. 2003-04
T.A.C. Willemse. Semantics and Veriﬁcation in Process Algebras with Data
and Timing. Faculty of Mathematics
and Computer Science, TU/e. 2003-05
S.V. Nedea. Analysis and Simulationsof Catalytic Reactions. Faculty of Mathematics and Computer Science, TU/e.
2003-06
M.E.M. Lijding. Real-time Schedulingof Tertiary Storage. Faculty of ElectricalEngineering, Mathematics & Computer
Science, UT. 2003-07
H.P. Benz. Casual Multimedia Process
Annotation – CoMPAs. Faculty of Electrical Engineering, Mathematics & Computer Science, UT. 2003-08
D. Distefano. On Modelchecking the
Dynamics of Object-based Software: aFoundational Approach. Faculty of Electrical Engineering, Mathematics & Computer Science, UT. 2003-09

G.I. Jojgov. Incomplete Proofs andTerms and Their Use in Interactive Theorem Proving. Faculty of Mathematics
and Computer Science, TU/e. 2004-02
P. Frisco. Theory of Molecular Computing – Splicing and Membrane systems. Faculty of Mathematics and Natural Sciences, UL. 2004-03
S. Maneth. Models of Tree Translation. Faculty of Mathematics and Natural Sciences, UL. 2004-04
Y. Qian. Data Synchronization and
Browsing for Home Environments. Faculty of Mathematics and Computer Science and Faculty of Industrial Design,
TU/e. 2004-05
F. Bartels. On Generalised Coinduction and Probabilistic Speciﬁcation Formats.
Faculty of Sciences, Divisionof Mathematics and Computer Science,
VUA. 2004-06
L. Cruz-Filipe.
Constructive Real
Analysis: a Type-Theoretical Formalization and Applications. Faculty of Science, Mathematics and Computer Science, KUN. 2004-07

M.H. ter Beek. Team Automata – A
Formal Approach to the Modeling of Collaboration Between System Components.
Faculty of Mathematics and Natural Sciences, UL. 2003-10

E.H. Gerding. Autonomous Agents in
Bargaining Games: An Evolutionary Investigation of Fundamentals, Strategies,
and Business Applications. Faculty ofTechnology Management, TU/e. 200408

D.J.P. Leijen. The λ Abroad – A
Functional Approach to Software Components. Faculty of Mathematics andComputer Science, UU. 2003-11

N. Goga. Control and Selection Techniques for the Automated Testing of Reactive Systems. Faculty of Mathematics
and Computer Science, TU/e. 2004-09

W.P.A.J. Michiels. Performance Ratios for the Diﬀerencing Method. Faculty of Mathematics and Computer Science, TU/e. 2004-01

M. Niqui. Formalising Exact Arithmetic: Representations, Algorithms andProofs. Faculty of Science, Mathematics
and Computer Science, RU. 2004-10

A. Löh. Exploring Generic Haskell.
Faculty of Mathematics and Computer
Science, UU. 2004-11
I.C.M. Flinsenberg. Route Planning
Algorithms for Car Navigation. Facultyof Mathematics and Computer Science,
TU/e. 2004-12
R.J. Bril. Real-time Scheduling forMedia Processing Using Conditionally
Guaranteed Budgets. Faculty of Mathematics and Computer Science, TU/e.
2004-13
J. Pang. Formal Veriﬁcation of Distributed Systems. Faculty of Sciences,
Division of Mathematics and Computer
Science, VUA. 2004-14
F. Alkemade. Evolutionary AgentBased Economics. Faculty of Technology Management, TU/e. 2004-15
E.O. Dijk. Indoor Ultrasonic Position
Estimation Using a Single Base Station.
Faculty of Mathematics and Computer
Science, TU/e. 2004-16
S.M. Orzan. On Distributed Veriﬁcation and Veriﬁed Distribution. Facultyof Sciences, Division of Mathematics andComputer Science, VUA. 2004-17
M.M. Schrage.
Proxima - A
Presentation-oriented Editor for Structured Documents. Faculty of Mathematics and Computer Science, UU. 2004-18
E. Eskenazi and A. Fyukov. Quantitative Prediction of Quality Attributes
for Component-Based Software Architectures. Faculty of Mathematics and Computer Science, TU/e. 2004-19
P.J.L. Cuijpers. Hybrid Process Algebra. Faculty of Mathematics and Computer Science, TU/e. 2004-20

N.J.M. van den Nieuwelaar. Supervisory Machine Control by PredictiveReactive Scheduling. Faculty of Mechanical Engineering, TU/e. 2004-21
E. Ábrahám. An Assertional Proof
System for Multithreaded Java -Theory
and Tool Support- . Faculty of Mathematics and Natural Sciences, UL. 200501
R. Ruimerman. Modeling and Remodeling in Bone Tissue. Faculty ofBiomedical Engineering, TU/e. 2005-02
C.N. Chong. Experiments in Rights
Control - Expression and Enforcement.
Faculty of Electrical Engineering, Mathematics & Computer Science, UT. 200503
H. Gao. Design and Veriﬁcation of
Lock-free Parallel Algorithms. Faculty ofMathematics and Computing Sciences,
RUG. 2005-04
H.M.A. van Beek. Speciﬁcation andAnalysis of Internet Applications. Faculty of Mathematics and Computer Science, TU/e. 2005-05
M.T. Ionita. Scenario-Based System
Architecting - A Systematic Approach to
Developing Future-Proof System Architectures. Faculty of Mathematics andComputing Sciences, TU/e. 2005-06
G. Lenzini.
Integration of Analysis Techniques in Security and FaultTolerance. Faculty of Electrical Engineering, Mathematics & Computer Science, UT. 2005-07
I. Kurtev.
Adaptability of Model
Transformations. Faculty of ElectricalEngineering, Mathematics & Computer
Science, UT. 2005-08
T. Wolle. Computational Aspects ofTreewidth - Lower Bounds and Network

Reliability.
2005-09

Faculty of Science, UU.

O. Tveretina. Decision Procedures for
Equality Logic with Uninterpreted Functions. Faculty of Mathematics and Computer Science, TU/e. 2005-10
A.M.L. Liekens. Evolution of Finite Populations in Dynamic Environments. Faculty of Biomedical Engineering, TU/e. 2005-11
J. Eggermont. Data Mining using Genetic Programming: Classiﬁcation andSymbolic Regression. Faculty of Mathematics and Natural Sciences, UL. 200512
B.J. Heeren. Top Quality Type Error
Messages. Faculty of Science, UU. 200513
G.F. Frehse. Compositional Veriﬁcation of Hybrid Systems using Simulation
Relations. Faculty of Science, Mathematics and Computer Science, RU. 200514
M.R. Mousavi. Structuring Structural Operational Semantics. Facultyof Mathematics and Computer Science,
TU/e. 2005-15

J.J. Vinju. Analysis and Transformation of Source Code by Parsing andRewriting. Faculty of Natural Sciences,
Mathematics, and Computer Science,
UvA. 2005-19
M.Valero Espada. Modal Abstraction
and Replication of Processes with Data.
Faculty of Sciences, Division of Mathematics and Computer Science, VUA.
2005-20
A. Dijkstra. Stepping through Haskell.
Faculty of Science, UU. 2005-21
Y.W. Law. Key management and linklayer security of wireless sensor networks: energy-eﬃcient attack and defense. Faculty of Electrical Engineering,
Mathematics & Computer Science, UT.
2005-22
E. Dolstra. The Purely Functional
Software Deployment Model. Faculty of
Science, UU. 2006-01
R.J. Corin. Analysis Models for Security Protocols. Faculty of ElectricalEngineering, Mathematics & Computer
Science, UT. 2006-02
P.R.A. Verbaan. The Computational
Complexity of Evolving Systems. Faculty of Science, UU. 2006-03

A. Sokolova. Coalgebraic Analysis of
Probabilistic Systems. Faculty of Mathematics and Computer Science, TU/e.
2005-16

K.L. Man and R.R.H. Schiﬀelers.
Formal Speciﬁcation and Analysis of Hybrid Systems. Faculty of Mathematics
and Computer Science and Faculty of
Mechanical Engineering, TU/e. 2006-04

T. Gelsema. Eﬀective Models for the
Structure of pi-Calculus Processes with
Replication. Faculty of Mathematics andNatural Sciences, UL. 2005-17

M. Kyas. Verifying OCL Speciﬁcationsof UML Models: Tool Support and Compositionality. Faculty of Mathematics
and Natural Sciences, UL. 2006-05

P. Zoeteweij. Composing Constraint
Solvers. Faculty of Natural Sciences,
Mathematics, and Computer Science,
UvA. 2005-18

M. Hendriks. Model Checking Timed
Automata - Techniques and Applications. Faculty of Science, Mathematics
and Computer Science, RU. 2006-06

J. Ketema.
Böhm-Like Trees for
Rewriting. Faculty of Sciences, VUA.
2006-07
C.-B. Breunesse. On JML: topics
in tool-assisted veriﬁcation of JML programs. Faculty of Science, Mathematics
and Computer Science, RU. 2006-08
B. Markvoort. Towards Hybrid Molecular Simulations. Faculty of Biomedical
Engineering, TU/e. 2006-09
S.G.R. Nijssen. Mining Structured
Data. Faculty of Mathematics and Natural Sciences, UL. 2006-10
G. Russello. Separation and Adaptation of Concerns in a Shared Data Space.
Faculty of Mathematics and Computer
Science, TU/e. 2006-11
L. Cheung. Reconciling Nondeterministic and Probabilistic Choices. Facultyof Science, Mathematics and Computer
Science, RU. 2006-12
B. Badban. Veriﬁcation techniques forExtensions of Equality Logic. Faculty of
Sciences, Division of Mathematics andComputer Science, VUA. 2006-13
A.J. Mooij. Constructive formal methods and protocol standardization. Faculty of Mathematics and Computer Science, TU/e. 2006-14

Engineering, Mathematics & Computer
Science, UT. 2006-17
B. Gebremichael.
Expressivity ofTimed Automata Models. Faculty of Science, Mathematics and Computer Science, RU. 2006-18
L.C.M. van Gool. Formalising Interface Speciﬁcations. Faculty of Mathematics and Computer Science, TU/e.
2006-19
C.J.F. Cremers. Scyther - Semantics
and Veriﬁcation of Security Protocols.
Faculty of Mathematics and Computer
Science, TU/e. 2006-20
J.V. Guillen Scholten. Mobile Channels for Exogenous Coordination of Distributed Systems: Semantics, Implementation and Composition.
Faculty ofMathematics and Natural Sciences, UL.
2006-21
H.A. de Jong. Flexible Heterogeneous
Software Systems. Faculty of Natural
Sciences, Mathematics, and Computer
Science, UvA. 2007-01
N.K. Kavaldjiev. A run-time reconﬁgurable Network-on-Chip for streaming
DSP applications. Faculty of ElectricalEngineering, Mathematics & Computer
Science, UT. 2007-02

T. Krilavicius. Hybrid Techniques for
Hybrid Systems. Faculty of ElectricalEngineering, Mathematics & Computer
Science, UT. 2006-15

M. van Veelen. Considerations on
Modeling for Early Detection of Abnormalities in Locally Autonomous Distributed Systems. Faculty of Mathematics and Computing Sciences, RUG. 200703

M.E. Warnier. Language Based Security for Java and JML. Faculty of Science, Mathematics and Computer Science, RU. 2006-16

T.D. Vu. Semantics and Applicationsof Process and Program Algebra. Faculty of Natural Sciences, Mathematics,
and Computer Science, UvA. 2007-04

V. Sundramoorthy. At Home In Service Discovery. Faculty of Electrical

L. Brandán Briones. Theories for
Model-based Testing: Real-time andCoverage. Faculty of Electrical Engineering, Mathematics & Computer Science, UT. 2007-05

Empirical Studies about the UML. Faculty of Mathematics and Computer Science, TU/e. 2007-14

I. Loeb. Natural Deduction: Sharing by Presentation. Faculty of Science, Mathematics and Computer Science, RU. 2007-06

T. van der Storm. Component-based
Conﬁguration, Integration and Delivery.
Faculty of Natural Sciences, Mathematics, and Computer Science,UvA. 2007-15

M.W.A. Streppel. Multifunctional
Geometric Data Structures.
Facultyof Mathematics and Computer Science,
TU/e. 2007-07

B.S. Graaf. Model-Driven Evolution ofSoftware Architectures. Faculty of Electrical Engineering, Mathematics, andComputer Science, TUD. 2007-16

N. Trčka. Silent Steps in Transition
Systems and Markov Chains. Facultyof Mathematics and Computer Science,
TU/e. 2007-08

A.H.J.Mathijssen.
Logical Calculi
for Reasoning with Binding. Facultyof Mathematics and Computer Science,
TU/e. 2007-17

R. Brinkman. Searching in encrypted
data. Faculty of Electrical Engineering,
Mathematics & Computer Science, UT.
2007-09

D. Jarnikov. QoS framework for Video
Streaming in Home Networks. Facultyof Mathematics and Computer Science,
TU/e. 2007-18

A. van Weelden. Putting types to gooduse. Faculty of Science, Mathematics
and Computer Science, RU. 2007-10

M. A. Abam. New Data Structures
and Algorithms for Mobile Data. Faculty of Mathematics and Computer Science, TU/e. 2007-19

J.A.R. Noppen. Imperfect Information in Software Development Processes.
Faculty of Electrical Engineering, Mathematics & Computer Science, UT. 200711

W.Pieters. La Volonté Machinale: Understanding the Electronic Voting Controversy. Faculty of Science, Mathematics and Computer Science, RU. 2008-01

R. Boumen.
Integration and Test
plans for Complex Manufacturing Systems. Faculty of Mechanical Engineering, TU/e. 2007-12

A.L. de Groot. Practical Automaton
Proofs in PVS. Faculty of Science, Mathematics and Computer Science, RU.
2008-02

A.J. Wijs.
What to do Next?:
Analysing and Optimising System Behaviour in Time. Faculty of Sciences,
Division of Mathematics and Computer
Science, VUA. 2007-13

M. Bruntink. Renovation of Idiomatic
Crosscutting Concerns in Embedded Systems. Faculty of Electrical Engineering, Mathematics, and Computer Science, TUD. 2008-03

C.F.J. Lange. Assessing and Improving the Quality of Modeling: A Series of

A.M. Marin. An Integrated System
to Manage Crosscutting Concerns inSource Code. Faculty of Electrical Engineering, Mathematics, and Computer
Science, TUD. 2008-04
N.C.W.M. Braspenning.
Modelbased Integration and Testing of Hightech Multi-disciplinary Systems. Facultyof Mechanical Engineering, TU/e. 200805
M. Bravenboer. Exercises in Free
Syntax: Syntax Deﬁnition, Parsing, andAssimilation of Language Conglomerates. Faculty of Science, UU. 2008-06
M. Torabi Dashti. Keeping Fairness

Alive: Design and Formal Veriﬁcationof Optimistic Fair Exchange Protocols.
Faculty of Sciences, Division of Mathematics and Computer Science, VUA.
2008-07
I.S.M. de Jong. Integration and Test
Strategies for Complex Manufacturing
Machines. Faculty of Mechanical Engineering, TU/e. 2008-08
I. Hasuo. Tracing Anonymity with
Coalgebras. Faculty of Science, Mathematics and Computer Science, RU. 200809